Documentation
¶
Index ¶
- Constants
- func WithAccessKey(with string) wrapping.Option
- func WithDisallowEnvVars(with bool) wrapping.Option
- func WithEndpoint(with string) wrapping.Option
- func WithKeyNotRequired(with bool) wrapping.Option
- func WithLogger(with hclog.Logger) wrapping.Option
- func WithRegion(with string) wrapping.Option
- func WithRoleArn(with string) wrapping.Option
- func WithRoleSessionName(with string) wrapping.Option
- func WithSecretKey(with string) wrapping.Option
- func WithSessionToken(with string) wrapping.Option
- func WithSharedCredsFilename(with string) wrapping.Option
- func WithSharedCredsProfile(with string) wrapping.Option
- func WithWebIdentityTokenFile(with string) wrapping.Option
- type OptionFunc
- type Wrapper
- func (k *Wrapper) Client() kmsiface.KMSAPI
- func (k *Wrapper) Decrypt(_ context.Context, in *wrapping.BlobInfo, opt ...wrapping.Option) ([]byte, error)
- func (k *Wrapper) Encrypt(_ context.Context, plaintext []byte, opt ...wrapping.Option) (*wrapping.BlobInfo, error)
- func (k *Wrapper) GetAwsKmsClient() (*kms.KMS, error)
- func (k *Wrapper) KeyId(_ context.Context) (string, error)
- func (k *Wrapper) SetConfig(_ context.Context, opt ...wrapping.Option) (*wrapping.WrapperConfig, error)
- func (k *Wrapper) Type(_ context.Context) (wrapping.WrapperType, error)
Constants ¶
const ( EnvAwsKmsWrapperKeyId = "AWSKMS_WRAPPER_KEY_ID" EnvVaultAwsKmsSealKeyId = "VAULT_AWSKMS_SEAL_KEY_ID" )
These constants contain the accepted env vars; the Vault one is for backwards compat
const ( // AwsKmsEncrypt is used to directly encrypt the data with KMS AwsKmsEncrypt = iota // AwsKmsEnvelopeAesGcmEncrypt is when a data encryption key is generated and // the data is encrypted with AES-GCM and the key is encrypted with KMS AwsKmsEnvelopeAesGcmEncrypt )
Variables ¶
This section is empty.
Functions ¶
func WithAccessKey ¶
WithAccessKey provides a way to chose the access key
func WithDisallowEnvVars ¶
WithDisallowEnvVars provides a way to disable using env vars
func WithEndpoint ¶
WithEndpoint provides a way to chose the endpoint
func WithKeyNotRequired ¶
WithKeyNotRequired provides a way to not require a key at config time
func WithLogger ¶
WithLogger provides a way to pass in a logger
func WithRegion ¶
WithRegion provides a way to chose the region
func WithRoleArn ¶
WithRoleArn provides a way to chose the role ARN
func WithRoleSessionName ¶
WithRoleSessionName provides a way to chose the role session name
func WithSecretKey ¶
WithSecretKey provides a way to chose the secret key
func WithSessionToken ¶
WithSessionToken provides a way to chose the session token
func WithSharedCredsFilename ¶
WithSharedCredsFilename provides a way to chose the shared creds filename
func WithSharedCredsProfile ¶
WithSharedCredsProfile provides a way to chose the shared creds profile
func WithWebIdentityTokenFile ¶
WithWebIdentityTokenFile provides a way to chose the web identity token file
Types ¶
type OptionFunc ¶
type OptionFunc func(*options) error
OptionFunc holds a function with local options
type Wrapper ¶
type Wrapper struct {
// contains filtered or unexported fields
}
Wrapper represents credentials and Key information for the KMS Key used to encryption and decryption
func NewAwsKmsTestWrapper ¶
func NewAwsKmsTestWrapper() *Wrapper
func NewWrapper ¶
func NewWrapper() *Wrapper
NewWrapper creates a new AwsKms wrapper with the provided options
func (*Wrapper) Decrypt ¶
func (k *Wrapper) Decrypt(_ context.Context, in *wrapping.BlobInfo, opt ...wrapping.Option) ([]byte, error)
Decrypt is used to decrypt the ciphertext. This should be called after Init.
func (*Wrapper) Encrypt ¶
func (k *Wrapper) Encrypt(_ context.Context, plaintext []byte, opt ...wrapping.Option) (*wrapping.BlobInfo, error)
Encrypt is used to encrypt the master key using the the AWS CMK. This returns the ciphertext, and/or any errors from this call. This should be called after the KMS client has been instantiated.
func (*Wrapper) GetAwsKmsClient ¶
GetAwsKmsClient returns an instance of the KMS client.
func (*Wrapper) SetConfig ¶
func (k *Wrapper) SetConfig(_ context.Context, opt ...wrapping.Option) (*wrapping.WrapperConfig, error)
SetConfig sets the fields on the Wrapper object based on values from the config parameter.
Order of precedence AWS values: * Environment variable * Passed in config map * Instance metadata role (access key and secret key) * Default values
Source Files