Skip to content

Commit d3e7920

Browse files
committed
docs(README): remove example & fix optional deps
1 parent 77c6557 commit d3e7920

File tree

1 file changed

+23
-177
lines changed

1 file changed

+23
-177
lines changed

README.md

+23-177
Original file line numberDiff line numberDiff line change
@@ -48,18 +48,21 @@ To use the DB-ESDK for DynamoDB in Java, you must have:
4848
the [Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files](http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html).
4949

5050
* **Declare a Dependency on the DB-ESDK for DynamoDB in Java and it's dependencies**
51-
The DB-ESDK for DynamoDB in Java requires the DynamoDB,
52-
Dynamodb-Enhanced, and KMS clients from the AWS SDK for Java V2.
51+
The DB-ESDK for DynamoDB in Java requires the Dynamodb-Enhanced client
52+
from the AWS SDK for Java V2.
5353
It also requires the AWS Cryptographic Material Providers library.
5454

55+
The KMS and DynamoDB Clients are **optional** dependencies.
56+
5557
* **Via Gradle Kotlin**
5658
In a Gradle Java Project, add the following to the _dependencies_ section:
5759
```kotlin
5860
implementation("software.amazon.cryptography:aws-database-encryption-sdk-dynamodb:3.0.0")
5961
implementation("software.amazon.cryptography:aws-cryptographic-material-providers:1.0.0")
6062
implementation(platform("software.amazon.awssdk:bom:2.19.1"))
61-
implementation("software.amazon.awssdk:dynamodb")
6263
implementation("software.amazon.awssdk:dynamodb-enhanced")
64+
// The following are optional:
65+
implementation("software.amazon.awssdk:dynamodb")
6366
implementation("software.amazon.awssdk:kms")
6467
```
6568

@@ -84,14 +87,6 @@ To use the DB-ESDK for DynamoDB in Java, you must have:
8487
<groupId>software.amazon.awssdk</groupId>
8588
<artifactId>dynamodb-enhanced</artifactId>
8689
</dependency>
87-
<dependency>
88-
<groupId>software.amazon.awssdk</groupId>
89-
<artifactId>dynamodb</artifactId>
90-
</dependency>
91-
<dependency>
92-
<groupId>software.amazon.awssdk</groupId>
93-
<artifactId>kms</artifactId>
94-
</dependency>
9590
<dependency>
9691
<groupId>software.amazon.cryptography</groupId>
9792
<artifactId>aws-database-encryption-sdk-dynamodb</artifactId>
@@ -102,6 +97,15 @@ To use the DB-ESDK for DynamoDB in Java, you must have:
10297
<artifactId>aws-cryptographic-material-providers</artifactId>
10398
<version>1.0.0</version>
10499
</dependency>
100+
<!-- The following are optional -->
101+
<dependency>
102+
<groupId>software.amazon.awssdk</groupId>
103+
<artifactId>dynamodb</artifactId>
104+
</dependency>
105+
<dependency>
106+
<groupId>software.amazon.awssdk</groupId>
107+
<artifactId>kms</artifactId>
108+
</dependency>
105109
</dependencies>
106110
...
107111
</project>
@@ -127,174 +131,16 @@ the AWS Database Encryption SDK for DynamoDB in Java.
127131
For help installing and using ACCP, see the
128132
[amazon-corretto-crypto-provider repository](https://github.com/corretto/amazon-corretto-crypto-provider).
129133

130-
## Configuring the DB-ESDK for DynamoDB in Java
134+
## Using the DB-ESDK for DynamoDB in Java
131135
There are several ways to use the
132136
AWS Database Encryption SDK (DB-ESDK) for DynamoDB in Java.
133-
More details are provided in the
134-
[AWS Database Encryption SDK Developer Guide](https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/).
135-
Also see the [Examples](Examples/runtimes/java/DynamoDbEncryption).
136-
137-
### Using Annotations
138-
139-
Suppose you have created a DynamoDB table via the request in
140-
[Examples/CreateSimpleTable](Examples/runtimes/java/Migration/PlaintextToAWSDBE/src/main/java/software/amazon/cryptography/examples/plaintext/CreateSimpleTable.java),
141-
and want to store some objects.
142-
The security requirements for these objects involves classifying particular
143-
attributes as sensitive information.
144-
You can use annotations from the Enhanced DynamoDB Client and the DB-ESDK to define
145-
the objects types and which fields are encrypted:
146-
147-
```java
148-
@DynamoDbBean
149-
public class SimpleClass {
150-
151-
private String partitionKey;
152-
private int sortKey;
153-
// The next three fields represent DynamoDB item attributes that we will perform cryptographic operations on.
154-
155-
// attribute1: Encrypt the data and sign it for authenticity
156-
private String attribute1;
157-
// attribute2: Do not encrypt but sign for authenticity
158-
private String attribute2;
159-
// attribute3: Do not encrypt and do not sign
160-
private String attribute3;
161-
162-
@DynamoDbPartitionKey
163-
@DynamoDbAttribute(value = "partition_key")
164-
public String getPartitionKey() { return this.partitionKey; }
165-
public void setPartitionKey(String partitionKey) { this.partitionKey = partitionKey; }
166-
167-
@DynamoDbSortKey
168-
@DynamoDbAttribute(value = "sort_key")
169-
public int getSortKey() { return this.sortKey; }
170-
public void setSortKey(int sortKey) { this.sortKey = sortKey; }
171-
172-
@DynamoDbAttribute(value = "attribute1")
173-
public String getAttribute1() { return this.attribute1; }
174-
public void setAttribute1(String attribute1) { this.attribute1 = attribute1; }
175-
176-
@DynamoDbEncryptionSignOnly
177-
@DynamoDbAttribute(value = "attribute2")
178-
public String getAttribute2() { return this.attribute2; }
179-
public void setAttribute2(String attribute2) { this.attribute2 = attribute2; }
180-
181-
@DynamoDbEncryptionDoNothing
182-
@DynamoDbAttribute(value = "attribute3")
183-
public String getAttribute3() { return this.attribute3; }
184-
public void setAttribute3(String attribute3) { this.attribute3 = attribute3; }
185-
}
186-
```
187-
188-
As a typical use case of the [DynamoDBEnhancedClient][ddbenhanced],
189-
you can easily save and retrieve a SimpleClass object
190-
to and from Amazon DynamoDB _without encryption (nor signing)_.
191-
For example,
192-
193-
```java
194-
// Create the DynamoDBEnhancedClient and our table
195-
DynamoDbClient ddb = DynamoDbClient.builder()...build();
196-
DynamoDbEnhancedClient enhancedClient = DynamoDbEnhancedClient.builder()
197-
.dynamoDbClient(ddb)
198-
.build();
199-
final TableSchema<SimpleClass> tableSchema = TableSchema.fromBean(SimpleClass.class);
200-
final DynamoDbTable<SimpleClass> table = enhancedClient.table(ddbTableName, tableSchema);
201-
202-
// Save the unencrypted item to DynamoDB
203-
SimpleClass itemToPut = new SimpleClass();
204-
itemToPut.setPartitionKey("anyKey");
205-
itemToPut.setSortKey(0);
206-
itemToPut.setAttribute1("this is not encrypted");
207-
table.putItem(itemToPut);
208-
209-
// Load the item back from DynamoDB
210-
SimpleClass itemToGet = new SimpleClass();
211-
itemToGet.setPartitionKey("anyKey");
212-
itemToGet.setSortKey(0);
213-
SimpleClass returnedItem = table.getItem(itemToGet);
214-
```
215-
216-
See
217-
[EnhancedPlaintextPutGetExample](Examples/runtimes/java/Migration/PlaintextToAWSDBE/src/main/java/software/amazon/cryptography/examples/plaintext/EnhancedPlaintextPutGetExample.java).
218-
219-
To enable transparent encryption and signing,
220-
create a keyring and a DynamoDbEncryptionInterceptor,
221-
then add it to the client.
222-
For example:
223-
224-
```java
225-
// Use an example KMS key for encrypting your data
226-
String encryptingKmsKeyArn = ...;
227-
228-
// Create encryption materials provider using your example KMS key
229-
MaterialProviders matProv = MaterialProviders.builder()
230-
.MaterialProvidersConfig(MaterialProvidersConfig.builder().build())
231-
.build();
232-
CreateAwsKmsMrkMultiKeyringInput keyringInput = CreateAwsKmsMrkMultiKeyringInput.builder()
233-
.generator(encryptingKmsKeyArn)
234-
.build();
235-
IKeyring kmsKeyring = matProv.CreateAwsKmsMrkMultiKeyring(keyringInput);
236-
237-
238-
// Create your encrypted table config
239-
Map<String, DynamoDbEnhancedTableEncryptionConfig> tableConfigs = new HashMap<>();
240-
tableConfigs.put(ddbTableName,
241-
DynamoDbEnhancedTableEncryptionConfig.builder()
242-
.logicalTableName(ddbTableName)
243-
.keyring(kmsKeyring)
244-
.schemaOnEncrypt(tableSchema)
245-
.allowedUnsignedAttributes(Arrays.asList("do_nothing"))
246-
.build());
247-
248-
// Create an interceptor to pass into the DDB client
249-
DynamoDbEncryptionInterceptor interceptor =
250-
DynamoDbEnhancedClientEncryption.CreateDynamoDbEncryptionInterceptor(
251-
CreateDynamoDbEncryptionInterceptorInput.builder()
252-
.tableEncryptionConfigs(tableConfigs)
253-
.build());
254-
255-
// Create the DDB client with our encryption interceptor
256-
DynamoDbClient ddb = DynamoDbClient.builder()
257-
.region(Region.US_WEST_2)
258-
.overrideConfiguration(
259-
ClientOverrideConfiguration.builder()
260-
.addExecutionInterceptor(interceptor)
261-
.build())
262-
.build();
263-
DynamoDbEnhancedClient enhancedClient = DynamoDbEnhancedClient.builder()
264-
.dynamoDbClient(ddb)
265-
.build();
266-
final DynamoDbTable<SimpleClass> table = enhancedClient.table(ddbTableName, tableSchema);
267-
268-
// Save the encrypted item to DynamoDB
269-
SimpleClass itemToPut = new SimpleClass();
270-
itemToPut.setPartitionKey("anyKey");
271-
itemToPut.setSortKey(0);
272-
itemToPut.setAttribute1("this is encrypted client-side");
273-
table.putItem(itemToPut);
274-
275-
// Load the item back from DynamoDB and decrypt client-side
276-
SimpleClass itemToGet = new SimpleClass();
277-
itemToGet.setPartitionKey("anyKey");
278-
itemToGet.setSortKey(0);
279-
SimpleClass returnedItem = table.getItem(itemToGet);
280-
```
281-
282-
See
283-
[EnhancedPutGetExample](Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/EnhancedPutGetExample.java)
284-
for more context and description.
285-
286-
# Development
287-
288-
[//]: # (TODO: Post-GA? Development Instructions)
289-
This repo contains several projects:
290-
- `DynamoDbEncryption`: The implementation of the Database Encryption
291-
SDK for DynamoDB in Java.
292-
- A specification of this project exists at `specification`.
293-
- `Examples`: Example projects that demonstrate use of
294-
the features of the Database Encryption SDK for DynamoDB
295-
- `TestVectors`: Project that encrypts and decrypts
296-
a suite of DynamoDB items to validate the Database Encryption
297-
SDK's cross-version compatibility
137+
Please read the
138+
[AWS Database Encryption SDK Developer Guide](https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/)
139+
for guidance.
140+
Also see the
141+
[DynamoDbEncryption Examples](Examples/runtimes/java/DynamoDbEncryption)
142+
and the
143+
[Migration Examples](Examples/runtimes/java/Migration).
298144

299145
# Contributing
300146

0 commit comments

Comments
 (0)