14
14
*/
15
15
package com .amazonaws .examples ;
16
16
17
+ import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .DynamoDBEncryptor ;
18
+ import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .EncryptionContext ;
19
+ import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .EncryptionFlags ;
20
+ import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .providers .WrappedMaterialsProvider ;
21
+ import com .amazonaws .services .dynamodbv2 .model .AttributeValue ;
17
22
import java .nio .ByteBuffer ;
18
23
import java .security .GeneralSecurityException ;
19
24
import java .security .KeyPair ;
23
28
import java .util .Map ;
24
29
import java .util .Set ;
25
30
26
- import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .DynamoDBEncryptor ;
27
- import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .EncryptionContext ;
28
- import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .EncryptionFlags ;
29
- import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .providers .WrappedMaterialsProvider ;
30
- import com .amazonaws .services .dynamodbv2 .model .AttributeValue ;
31
-
32
31
/**
33
- * Example showing use of RSA keys for encryption and signing.
34
- * For ease of the example, we create new random ones every time.
32
+ * Example showing use of RSA keys for encryption and signing. For ease of the example, we create
33
+ * new random ones every time.
35
34
*/
36
35
public class AsymmetricEncryptedItem {
37
36
private static final String STRING_FIELD_NAME = "example" ;
@@ -50,7 +49,8 @@ public static void main(String[] args) throws GeneralSecurityException {
50
49
encryptRecord (tableName , wrappingKeys , signingKeys );
51
50
}
52
51
53
- public static void encryptRecord (String tableName , KeyPair wrappingKeys , KeyPair signingKeys ) throws GeneralSecurityException {
52
+ public static void encryptRecord (String tableName , KeyPair wrappingKeys , KeyPair signingKeys )
53
+ throws GeneralSecurityException {
54
54
// Sample record to be encrypted
55
55
final String partitionKeyName = "partition_attribute" ;
56
56
final String sortKeyName = "sort_attribute" ;
@@ -59,25 +59,34 @@ public static void encryptRecord(String tableName, KeyPair wrappingKeys, KeyPair
59
59
record .put (sortKeyName , new AttributeValue ().withN ("55" ));
60
60
record .put (STRING_FIELD_NAME , new AttributeValue ().withS ("data" ));
61
61
record .put (NUMBER_FIELD_NAME , new AttributeValue ().withN ("99" ));
62
- record .put (BINARY_FIELD_NAME , new AttributeValue ().withB (ByteBuffer .wrap (new byte []{0x00 , 0x01 , 0x02 })));
63
- record .put (IGNORED_FIELD_NAME , new AttributeValue ().withS ("alone" )); // We want to ignore this attribute
62
+ record .put (
63
+ BINARY_FIELD_NAME ,
64
+ new AttributeValue ().withB (ByteBuffer .wrap (new byte [] {0x00 , 0x01 , 0x02 })));
65
+ record .put (
66
+ IGNORED_FIELD_NAME ,
67
+ new AttributeValue ().withS ("alone" )); // We want to ignore this attribute
64
68
65
- // Set up our configuration and clients. All of this is thread-safe and can be reused across calls.
69
+ // Set up our configuration and clients. All of this is thread-safe and can be reused across
70
+ // calls.
66
71
// Provider Configuration
67
- final WrappedMaterialsProvider cmp = new WrappedMaterialsProvider (wrappingKeys .getPublic (), wrappingKeys .getPrivate (), signingKeys );
72
+ final WrappedMaterialsProvider cmp =
73
+ new WrappedMaterialsProvider (
74
+ wrappingKeys .getPublic (), wrappingKeys .getPrivate (), signingKeys );
68
75
// Encryptor creation
69
76
final DynamoDBEncryptor encryptor = DynamoDBEncryptor .getInstance (cmp );
70
77
71
78
// Information about the context of our data (normally just Table information)
72
- final EncryptionContext encryptionContext = new EncryptionContext .Builder ()
73
- .withTableName (tableName )
74
- .withHashKeyName (partitionKeyName )
75
- .withRangeKeyName (sortKeyName )
76
- .build ();
79
+ final EncryptionContext encryptionContext =
80
+ new EncryptionContext .Builder ()
81
+ .withTableName (tableName )
82
+ .withHashKeyName (partitionKeyName )
83
+ .withRangeKeyName (sortKeyName )
84
+ .build ();
77
85
78
86
// Describe what actions need to be taken for each attribute
79
87
final EnumSet <EncryptionFlags > signOnly = EnumSet .of (EncryptionFlags .SIGN );
80
- final EnumSet <EncryptionFlags > encryptAndSign = EnumSet .of (EncryptionFlags .ENCRYPT , EncryptionFlags .SIGN );
88
+ final EnumSet <EncryptionFlags > encryptAndSign =
89
+ EnumSet .of (EncryptionFlags .ENCRYPT , EncryptionFlags .SIGN );
81
90
final Map <String , Set <EncryptionFlags >> actions = new HashMap <>();
82
91
for (final String attributeName : record .keySet ()) {
83
92
switch (attributeName ) {
@@ -98,13 +107,22 @@ public static void encryptRecord(String tableName, KeyPair wrappingKeys, KeyPair
98
107
// End set-up
99
108
100
109
// Encrypt the plaintext record directly
101
- final Map <String , AttributeValue > encrypted_record = encryptor .encryptRecord (record , actions , encryptionContext );
110
+ final Map <String , AttributeValue > encrypted_record =
111
+ encryptor .encryptRecord (record , actions , encryptionContext );
102
112
103
113
// Encrypted record fields change as expected
104
- assert encrypted_record .get (STRING_FIELD_NAME ).getB () != null ; // the encrypted string is stored as bytes
105
- assert encrypted_record .get (NUMBER_FIELD_NAME ).getB () != null ; // the encrypted number is stored as bytes
106
- assert !record .get (BINARY_FIELD_NAME ).getB ().equals (encrypted_record .get (BINARY_FIELD_NAME ).getB ()); // the encrypted bytes have updated
107
- assert record .get (IGNORED_FIELD_NAME ).getS ().equals (encrypted_record .get (IGNORED_FIELD_NAME ).getS ()); // ignored field is left as is
114
+ assert encrypted_record .get (STRING_FIELD_NAME ).getB ()
115
+ != null ; // the encrypted string is stored as bytes
116
+ assert encrypted_record .get (NUMBER_FIELD_NAME ).getB ()
117
+ != null ; // the encrypted number is stored as bytes
118
+ assert !record
119
+ .get (BINARY_FIELD_NAME )
120
+ .getB ()
121
+ .equals (encrypted_record .get (BINARY_FIELD_NAME ).getB ()); // the encrypted bytes have updated
122
+ assert record
123
+ .get (IGNORED_FIELD_NAME )
124
+ .getS ()
125
+ .equals (encrypted_record .get (IGNORED_FIELD_NAME ).getS ()); // ignored field is left as is
108
126
109
127
// We could now put the encrypted item to DynamoDB just as we would any other item.
110
128
// We're skipping it to to keep the example simpler.
@@ -113,12 +131,22 @@ public static void encryptRecord(String tableName, KeyPair wrappingKeys, KeyPair
113
131
System .out .println ("Encrypted Record: " + encrypted_record );
114
132
115
133
// Decryption is identical. We'll pretend that we retrieved the record from DynamoDB.
116
- final Map <String , AttributeValue > decrypted_record = encryptor .decryptRecord (encrypted_record , actions , encryptionContext );
134
+ final Map <String , AttributeValue > decrypted_record =
135
+ encryptor .decryptRecord (encrypted_record , actions , encryptionContext );
117
136
System .out .println ("Decrypted Record: " + decrypted_record );
118
137
119
138
// The decrypted fields match the original fields before encryption
120
- assert record .get (STRING_FIELD_NAME ).getS ().equals (decrypted_record .get (STRING_FIELD_NAME ).getS ());
121
- assert record .get (NUMBER_FIELD_NAME ).getN ().equals (decrypted_record .get (NUMBER_FIELD_NAME ).getN ());
122
- assert record .get (BINARY_FIELD_NAME ).getB ().equals (decrypted_record .get (BINARY_FIELD_NAME ).getB ());
139
+ assert record
140
+ .get (STRING_FIELD_NAME )
141
+ .getS ()
142
+ .equals (decrypted_record .get (STRING_FIELD_NAME ).getS ());
143
+ assert record
144
+ .get (NUMBER_FIELD_NAME )
145
+ .getN ()
146
+ .equals (decrypted_record .get (NUMBER_FIELD_NAME ).getN ());
147
+ assert record
148
+ .get (BINARY_FIELD_NAME )
149
+ .getB ()
150
+ .equals (decrypted_record .get (BINARY_FIELD_NAME ).getB ());
123
151
}
124
152
}
0 commit comments