@@ -48,18 +48,21 @@ To use the DB-ESDK for DynamoDB in Java, you must have:
48
48
the [ Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files] ( http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html ) .
49
49
50
50
* ** Declare a Dependency on the DB-ESDK for DynamoDB in Java and it's dependencies**
51
- The DB-ESDK for DynamoDB in Java requires the DynamoDB,
52
- Dynamodb-Enhanced, and KMS clients from the AWS SDK for Java V2.
51
+ The DB-ESDK for DynamoDB in Java requires the Dynamodb-Enhanced client
52
+ from the AWS SDK for Java V2.
53
53
It also requires the AWS Cryptographic Material Providers library.
54
54
55
+ The KMS and DynamoDB Clients are ** optional** dependencies.
56
+
55
57
* ** Via Gradle Kotlin**
56
58
In a Gradle Java Project, add the following to the _ dependencies_ section:
57
59
``` kotlin
58
60
implementation(" software.amazon.cryptography:aws-database-encryption-sdk-dynamodb:3.0.0" )
59
61
implementation(" software.amazon.cryptography:aws-cryptographic-material-providers:1.0.0" )
60
62
implementation(platform(" software.amazon.awssdk:bom:2.19.1" ))
61
- implementation(" software.amazon.awssdk:dynamodb" )
62
63
implementation(" software.amazon.awssdk:dynamodb-enhanced" )
64
+ // The following are optional:
65
+ implementation(" software.amazon.awssdk:dynamodb" )
63
66
implementation(" software.amazon.awssdk:kms" )
64
67
```
65
68
@@ -84,14 +87,6 @@ To use the DB-ESDK for DynamoDB in Java, you must have:
84
87
<groupId >software.amazon.awssdk</groupId >
85
88
<artifactId >dynamodb-enhanced</artifactId >
86
89
</dependency >
87
- <dependency >
88
- <groupId >software.amazon.awssdk</groupId >
89
- <artifactId >dynamodb</artifactId >
90
- </dependency >
91
- <dependency >
92
- <groupId >software.amazon.awssdk</groupId >
93
- <artifactId >kms</artifactId >
94
- </dependency >
95
90
<dependency >
96
91
<groupId >software.amazon.cryptography</groupId >
97
92
<artifactId >aws-database-encryption-sdk-dynamodb</artifactId >
@@ -102,6 +97,15 @@ To use the DB-ESDK for DynamoDB in Java, you must have:
102
97
<artifactId >aws-cryptographic-material-providers</artifactId >
103
98
<version >1.0.0</version >
104
99
</dependency >
100
+ <!-- The following are optional -->
101
+ <dependency >
102
+ <groupId >software.amazon.awssdk</groupId >
103
+ <artifactId >dynamodb</artifactId >
104
+ </dependency >
105
+ <dependency >
106
+ <groupId >software.amazon.awssdk</groupId >
107
+ <artifactId >kms</artifactId >
108
+ </dependency >
105
109
</dependencies >
106
110
...
107
111
</project >
@@ -127,174 +131,16 @@ the AWS Database Encryption SDK for DynamoDB in Java.
127
131
For help installing and using ACCP, see the
128
132
[ amazon-corretto-crypto-provider repository] ( https://github.com/corretto/amazon-corretto-crypto-provider ) .
129
133
130
- ## Configuring the DB-ESDK for DynamoDB in Java
134
+ ## Using the DB-ESDK for DynamoDB in Java
131
135
There are several ways to use the
132
136
AWS Database Encryption SDK (DB-ESDK) for DynamoDB in Java.
133
- More details are provided in the
134
- [ AWS Database Encryption SDK Developer Guide] ( https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/ ) .
135
- Also see the [ Examples] ( Examples/runtimes/java/DynamoDbEncryption ) .
136
-
137
- ### Using Annotations
138
-
139
- Suppose you have created a DynamoDB table via the request in
140
- [ Examples/CreateSimpleTable] ( Examples/runtimes/java/Migration/PlaintextToAWSDBE/src/main/java/software/amazon/cryptography/examples/plaintext/CreateSimpleTable.java ) ,
141
- and want to store some objects.
142
- The security requirements for these objects involves classifying particular
143
- attributes as sensitive information.
144
- You can use annotations from the Enhanced DynamoDB Client and the DB-ESDK to define
145
- the objects types and which fields are encrypted:
146
-
147
- ``` java
148
- @DynamoDbBean
149
- public class SimpleClass {
150
-
151
- private String partitionKey;
152
- private int sortKey;
153
- // The next three fields represent DynamoDB item attributes that we will perform cryptographic operations on.
154
-
155
- // attribute1: Encrypt the data and sign it for authenticity
156
- private String attribute1;
157
- // attribute2: Do not encrypt but sign for authenticity
158
- private String attribute2;
159
- // attribute3: Do not encrypt and do not sign
160
- private String attribute3;
161
-
162
- @DynamoDbPartitionKey
163
- @DynamoDbAttribute (value = " partition_key" )
164
- public String getPartitionKey () { return this . partitionKey; }
165
- public void setPartitionKey (String partitionKey ) { this . partitionKey = partitionKey; }
166
-
167
- @DynamoDbSortKey
168
- @DynamoDbAttribute (value = " sort_key" )
169
- public int getSortKey () { return this . sortKey; }
170
- public void setSortKey (int sortKey ) { this . sortKey = sortKey; }
171
-
172
- @DynamoDbAttribute (value = " attribute1" )
173
- public String getAttribute1 () { return this . attribute1; }
174
- public void setAttribute1 (String attribute1 ) { this . attribute1 = attribute1; }
175
-
176
- @DynamoDbEncryptionSignOnly
177
- @DynamoDbAttribute (value = " attribute2" )
178
- public String getAttribute2 () { return this . attribute2; }
179
- public void setAttribute2 (String attribute2 ) { this . attribute2 = attribute2; }
180
-
181
- @DynamoDbEncryptionDoNothing
182
- @DynamoDbAttribute (value = " attribute3" )
183
- public String getAttribute3 () { return this . attribute3; }
184
- public void setAttribute3 (String attribute3 ) { this . attribute3 = attribute3; }
185
- }
186
- ```
187
-
188
- As a typical use case of the [ DynamoDBEnhancedClient] [ ddbenhanced ] ,
189
- you can easily save and retrieve a SimpleClass object
190
- to and from Amazon DynamoDB _ without encryption (nor signing)_ .
191
- For example,
192
-
193
- ``` java
194
- // Create the DynamoDBEnhancedClient and our table
195
- DynamoDbClient ddb = DynamoDbClient . builder().. . build();
196
- DynamoDbEnhancedClient enhancedClient = DynamoDbEnhancedClient . builder()
197
- .dynamoDbClient(ddb)
198
- .build();
199
- final TableSchema<SimpleClass > tableSchema = TableSchema . fromBean(SimpleClass . class);
200
- final DynamoDbTable<SimpleClass > table = enhancedClient. table(ddbTableName, tableSchema);
201
-
202
- // Save the unencrypted item to DynamoDB
203
- SimpleClass itemToPut = new SimpleClass ();
204
- itemToPut. setPartitionKey(" anyKey" );
205
- itemToPut. setSortKey(0 );
206
- itemToPut. setAttribute1(" this is not encrypted" );
207
- table. putItem(itemToPut);
208
-
209
- // Load the item back from DynamoDB
210
- SimpleClass itemToGet = new SimpleClass ();
211
- itemToGet. setPartitionKey(" anyKey" );
212
- itemToGet. setSortKey(0 );
213
- SimpleClass returnedItem = table. getItem(itemToGet);
214
- ```
215
-
216
- See
217
- [ EnhancedPlaintextPutGetExample] ( Examples/runtimes/java/Migration/PlaintextToAWSDBE/src/main/java/software/amazon/cryptography/examples/plaintext/EnhancedPlaintextPutGetExample.java ) .
218
-
219
- To enable transparent encryption and signing,
220
- create a keyring and a DynamoDbEncryptionInterceptor,
221
- then add it to the client.
222
- For example:
223
-
224
- ``` java
225
- // Use an example KMS key for encrypting your data
226
- String encryptingKmsKeyArn = ... ;
227
-
228
- // Create encryption materials provider using your example KMS key
229
- MaterialProviders matProv = MaterialProviders . builder()
230
- .MaterialProvidersConfig(MaterialProvidersConfig . builder(). build())
231
- .build();
232
- CreateAwsKmsMrkMultiKeyringInput keyringInput = CreateAwsKmsMrkMultiKeyringInput . builder()
233
- .generator(encryptingKmsKeyArn)
234
- .build();
235
- IKeyring kmsKeyring = matProv. CreateAwsKmsMrkMultiKeyring (keyringInput);
236
-
237
-
238
- // Create your encrypted table config
239
- Map<String , DynamoDbEnhancedTableEncryptionConfig > tableConfigs = new HashMap<> ();
240
- tableConfigs. put(ddbTableName,
241
- DynamoDbEnhancedTableEncryptionConfig . builder()
242
- .logicalTableName(ddbTableName)
243
- .keyring(kmsKeyring)
244
- .schemaOnEncrypt(tableSchema)
245
- .allowedUnsignedAttributes(Arrays . asList(" do_nothing" ))
246
- .build());
247
-
248
- // Create an interceptor to pass into the DDB client
249
- DynamoDbEncryptionInterceptor interceptor =
250
- DynamoDbEnhancedClientEncryption . CreateDynamoDbEncryptionInterceptor(
251
- CreateDynamoDbEncryptionInterceptorInput . builder()
252
- .tableEncryptionConfigs(tableConfigs)
253
- .build());
254
-
255
- // Create the DDB client with our encryption interceptor
256
- DynamoDbClient ddb = DynamoDbClient . builder()
257
- .region(Region . US_WEST_2 )
258
- .overrideConfiguration(
259
- ClientOverrideConfiguration . builder()
260
- .addExecutionInterceptor(interceptor)
261
- .build())
262
- .build();
263
- DynamoDbEnhancedClient enhancedClient = DynamoDbEnhancedClient . builder()
264
- .dynamoDbClient(ddb)
265
- .build();
266
- final DynamoDbTable<SimpleClass > table = enhancedClient. table(ddbTableName, tableSchema);
267
-
268
- // Save the encrypted item to DynamoDB
269
- SimpleClass itemToPut = new SimpleClass ();
270
- itemToPut. setPartitionKey(" anyKey" );
271
- itemToPut. setSortKey(0 );
272
- itemToPut. setAttribute1(" this is encrypted client-side" );
273
- table. putItem(itemToPut);
274
-
275
- // Load the item back from DynamoDB and decrypt client-side
276
- SimpleClass itemToGet = new SimpleClass ();
277
- itemToGet. setPartitionKey(" anyKey" );
278
- itemToGet. setSortKey(0 );
279
- SimpleClass returnedItem = table. getItem(itemToGet);
280
- ```
281
-
282
- See
283
- [ EnhancedPutGetExample] ( Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/EnhancedPutGetExample.java )
284
- for more context and description.
285
-
286
- # Development
287
-
288
- [ // ] : # ( TODO: Post-GA? Development Instructions )
289
- This repo contains several projects:
290
- - ` DynamoDbEncryption ` : The implementation of the Database Encryption
291
- SDK for DynamoDB in Java.
292
- - A specification of this project exists at ` specification ` .
293
- - ` Examples ` : Example projects that demonstrate use of
294
- the features of the Database Encryption SDK for DynamoDB
295
- - ` TestVectors ` : Project that encrypts and decrypts
296
- a suite of DynamoDB items to validate the Database Encryption
297
- SDK's cross-version compatibility
137
+ Please read the
138
+ [ AWS Database Encryption SDK Developer Guide] ( https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/ )
139
+ for guidance.
140
+ Also see the
141
+ [ DynamoDbEncryption Examples] ( Examples/runtimes/java/DynamoDbEncryption )
142
+ and the
143
+ [ Migration Examples] ( Examples/runtimes/java/Migration ) .
298
144
299
145
# Contributing
300
146
0 commit comments