Skip to content

Commit a3e871b

Browse files
committed
WIP
1 parent 33ff5a3 commit a3e871b

File tree

5 files changed

+71
-49
lines changed

5 files changed

+71
-49
lines changed

example/main.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ func main() {
5454
// Initialize EncryptedClient
5555
ec := encrypted.NewEncryptedClient(dynamoDBClient, cmp, clientConfig)
5656

57+
// Create an EncryptedTable instance
58+
et := encrypted.NewEncryptedTable(ec)
59+
5760
// User credentials to encrypt and store
5861
userID := "user1"
5962
credentials := map[string]types.AttributeValue{
@@ -193,6 +196,21 @@ func main() {
193196
log.Fatalf("Failed during paginated scan: %v", err)
194197
}
195198

199+
// Put encrypted item using EncryptedTable
200+
if err := et.PutItem(ctx, tableName, credentials); err != nil {
201+
log.Fatalf("Failed to put encrypted item: %v", err)
202+
}
203+
fmt.Println("Encrypted item put successfully.")
204+
205+
// Get and decrypt item using EncryptedTable
206+
decryptedItem, err := et.GetItem(ctx, tableName, map[string]types.AttributeValue{
207+
"UserID": &types.AttributeValueMemberS{Value: userID},
208+
})
209+
if err != nil {
210+
log.Fatalf("Failed to get and decrypt item: %v", err)
211+
}
212+
fmt.Printf("Decrypted item: %v\n", decryptedItem)
213+
196214
}
197215

198216
func createTableIfNotExists(ctx context.Context, client *dynamodb.Client, tableName string) error {

go.mod

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,23 @@ module github.com/cloudopsy/dynamodb-encryption-go
33
go 1.21.7
44

55
require (
6-
github.com/aws/aws-sdk-go v1.51.4
6+
github.com/aws/aws-sdk-go v1.51.6
77
github.com/aws/aws-sdk-go-v2 v1.26.0
8-
github.com/aws/aws-sdk-go-v2/config v1.27.8
8+
github.com/aws/aws-sdk-go-v2/config v1.27.9
9+
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.11
910
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.31.0
1011
github.com/stretchr/testify v1.9.0
1112
github.com/tink-crypto/tink-go-awskms v0.0.0-20230616072154-ba4f9f22c3e9
1213
github.com/tink-crypto/tink-go/v2 v2.1.0
1314
)
1415

1516
require (
16-
github.com/aws/aws-sdk-go-v2/credentials v1.17.8 // indirect
17-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.4 // indirect
17+
github.com/aws/aws-sdk-go-v2/credentials v1.17.9 // indirect
18+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 // indirect
1819
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 // indirect
1920
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 // indirect
2021
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
22+
github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.20.3 // indirect
2123
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1 // indirect
2224
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.9.5 // indirect
2325
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.6 // indirect

go.sum

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,23 @@
11
github.com/aws/aws-sdk-go v1.51.4 h1:yOVfGhRJyReBrACK0alLosJl8iXhWkNY1vrePYmhHdw=
22
github.com/aws/aws-sdk-go v1.51.4/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
3+
github.com/aws/aws-sdk-go v1.51.6 h1:Ld36dn9r7P9IjU8WZSaswQ8Y/XUCRpewim5980DwYiU=
4+
github.com/aws/aws-sdk-go v1.51.6/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
35
github.com/aws/aws-sdk-go-v2 v1.26.0 h1:/Ce4OCiM3EkpW7Y+xUnfAFpchU78K7/Ug01sZni9PgA=
46
github.com/aws/aws-sdk-go-v2 v1.26.0/go.mod h1:35hUlJVYd+M++iLI3ALmVwMOyRYMmRqUXpTtRGW+K9I=
57
github.com/aws/aws-sdk-go-v2/config v1.27.8 h1:0r8epOsiJ7YJz65MGcb8i91ehFp4kvvFe2qkq5oYeRI=
68
github.com/aws/aws-sdk-go-v2/config v1.27.8/go.mod h1:XsmYKxYNuIhLsFddpNds+j9H5XKzjWDdg/SZngiwFio=
9+
github.com/aws/aws-sdk-go-v2/config v1.27.9 h1:gRx/NwpNEFSk+yQlgmk1bmxxvQ5TyJ76CWXs9XScTqg=
10+
github.com/aws/aws-sdk-go-v2/config v1.27.9/go.mod h1:dK1FQfpwpql83kbD873E9vz4FyAxuJtR22wzoXn3qq0=
711
github.com/aws/aws-sdk-go-v2/credentials v1.17.8 h1:WUdNLXbyNbU07V/WFrSOBXqZTDgmmMNMgUFzpYOKJhw=
812
github.com/aws/aws-sdk-go-v2/credentials v1.17.8/go.mod h1:iPZzLpaBIfhyvVS/XGD3JvR1GP3YdHTqpySKDlqkfs8=
13+
github.com/aws/aws-sdk-go-v2/credentials v1.17.9 h1:N8s0/7yW+h8qR8WaRlPQeJ6czVMNQVNtNdUqf6cItao=
14+
github.com/aws/aws-sdk-go-v2/credentials v1.17.9/go.mod h1:446YhIdmSV0Jf/SLafGZalQo+xr2iw7/fzXGDPTU1yQ=
15+
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.11 h1:nyWawIVs7Y75DuNhh6vao/qmKKWS56zUuWt/+dOE5iI=
16+
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.11/go.mod h1:5WPGXfp9+ss7gYsZ5QjJeY16qTpCLaIcQItE7Yw7ld4=
917
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.4 h1:S+L2QSKhUuShih3aq9P/mkzDBiOO5tTyVg+vXREfsfg=
1018
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.4/go.mod h1:nQ3how7DMnFMWiU1SpECohgC82fpn4cKZ875NDMmwtA=
19+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 h1:af5YzcLf80tv4Em4jWVD75lpnOHSBkPUZxZfGkrI3HI=
20+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0/go.mod h1:nQ3how7DMnFMWiU1SpECohgC82fpn4cKZ875NDMmwtA=
1121
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 h1:0ScVK/4qZ8CIW0k8jOeFVsyS/sAiXpYxRBLolMkuLQM=
1222
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4/go.mod h1:84KyjNZdHC6QZW08nfHI6yZgPd+qRgaWcYsyLUo3QY8=
1323
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 h1:sHmMWWX5E7guWEFQ9SVo6A3S4xpPrWnd77a6y4WM6PU=
@@ -16,6 +26,8 @@ github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7
1626
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
1727
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.31.0 h1:LtsNRZ6+ZYIbJcPiLHcefXeWkw2DZT9iJyXJJQvhvXw=
1828
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.31.0/go.mod h1:ua1eYOCxAAT0PUY3LAi9bUFuKJHC/iAksBLqR1Et7aU=
29+
github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.20.3 h1:KOjg2W7v3tAU8ASDWw26os1OywstODoZdIh9b/Wwlm4=
30+
github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.20.3/go.mod h1:fw1lVv+e9z9UIaVsVjBXoC8QxZ+ibOtRtzfELRJZWs8=
1931
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1 h1:EyBZibRTVAs6ECHZOw5/wlylS9OcTzwyjeQMudmREjE=
2032
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1/go.mod h1:JKpmtYhhPs7D97NL/ltqz7yCkERFW5dOlHyVl66ZYF8=
2133
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.9.5 h1:4vkDuYdXXD2xLgWmNalqH3q4u/d1XnaBMBXdVdZXVp0=

pkg/encrypted/client.go

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,15 +107,23 @@ type EncryptedClient struct {
107107
}
108108

109109
// NewEncryptedClient creates a new instance of EncryptedClient.
110-
func NewEncryptedClient(client DynamoDBClientInterface, materialsProvider provider.CryptographicMaterialsProvider, config *ClientConfig) *EncryptedClient {
111-
return &EncryptedClient{
110+
func NewEncryptedClient(client DynamoDBClientInterface, materialsProvider provider.CryptographicMaterialsProvider, opts ...EncryptedClientOption) *EncryptedClient {
111+
112+
ec := &EncryptedClient{
112113
Client: client,
113114
MaterialsProvider: materialsProvider,
114115
PrimaryKeyCache: make(map[string]*PrimaryKeyInfo),
115-
ClientConfig: config,
116+
ClientConfig: NewClientConfig(WithDefaultEncryption(EncryptStandard)),
117+
lock: sync.RWMutex{},
118+
}
116119

117-
lock: sync.RWMutex{},
120+
// Apply each option to the instance
121+
for _, opt := range opts {
122+
opt(ec)
118123
}
124+
125+
return ec
126+
119127
}
120128

121129
// CreateTable creates a new DynamoDB table with the specified name, attribute definitions, and key schema.

pkg/encrypted/config.go

Lines changed: 23 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -4,66 +4,41 @@ package encrypted
44
type EncryptionAction int
55

66
const (
7-
// EncryptNone indicates that no encryption should be applied.
8-
EncryptNone EncryptionAction = iota
9-
// EncryptStandard indicates the attribute should be encrypted using a standard algorithm.
10-
EncryptStandard
11-
// EncryptDeterministic indicates the attribute should be encrypted deterministically for consistent outcomes.
12-
EncryptDeterministic
7+
EncryptNone EncryptionAction = iota // No encryption should be applied.
8+
EncryptStandard // The attribute should be encrypted using a standard algorithm.
9+
EncryptDeterministic // The attribute should be encrypted deterministically for consistent outcomes.
1310
// Additional encryption actions can be defined here.
1411
)
1512

16-
// CompressionAction represents the compression action to be taken on a specific attribute.
17-
type CompressionAction int
18-
19-
const (
20-
// CompressNone indicates no compression should be applied.
21-
CompressNone CompressionAction = iota
22-
// CompressGzip indicates the attribute should be compressed using GZip.
23-
CompressGzip
24-
// CompressZstd indicates the attribute should be compressed using Zstd.
25-
CompressZstd
26-
)
27-
28-
// ClientConfig holds the configuration for client operations like encryption and compression.
13+
// ClientConfig holds the configuration for client operations, focusing on encryption.
2914
type ClientConfig struct {
30-
Encryption EncryptionConfig
31-
Compression CompressionConfig
15+
Encryption EncryptionConfig
3216
}
3317

34-
// EncryptionConfig holds encryption-specific settings.
18+
// EncryptionConfig holds encryption-specific settings, including a default action and specific actions for named attributes.
3519
type EncryptionConfig struct {
36-
DefaultAction EncryptionAction
37-
SpecificActions map[string]EncryptionAction
38-
}
39-
40-
// CompressionConfig holds compression-specific settings.
41-
type CompressionConfig struct {
42-
DefaultAction CompressionAction
43-
SpecificActions map[string]CompressionAction
20+
DefaultAction EncryptionAction // The default encryption action if no specific action is provided.
21+
SpecificActions map[string]EncryptionAction // Map of attribute names to their specific encryption actions.
4422
}
4523

46-
// NewClientConfig creates a new ClientConfig with provided options.
24+
// NewClientConfig initializes a new ClientConfig, applying any provided functional options.
4725
func NewClientConfig(options ...Option) *ClientConfig {
4826
config := &ClientConfig{
4927
Encryption: EncryptionConfig{
50-
DefaultAction: EncryptNone,
28+
DefaultAction: EncryptNone, // Default to no encryption unless specified.
5129
SpecificActions: make(map[string]EncryptionAction),
5230
},
53-
Compression: CompressionConfig{
54-
DefaultAction: CompressNone,
55-
SpecificActions: make(map[string]CompressionAction),
56-
},
5731
}
5832

33+
// Apply each provided option to the ClientConfig.
5934
for _, option := range options {
6035
option(config)
6136
}
6237

6338
return config
6439
}
6540

66-
// Option applies a configuration to a ClientConfig.
41+
// Option defines a function signature for options that modify ClientConfig.
6742
type Option func(*ClientConfig)
6843

6944
// WithDefaultEncryptionAction sets the default encryption action for the client.
@@ -73,12 +48,19 @@ func WithDefaultEncryption(action EncryptionAction) Option {
7348
}
7449
}
7550

76-
// WithEncryption sets an encryption action for a specific attribute.
51+
// WithEncryption sets a specific encryption action for a named attribute.
7752
func WithEncryption(attributeName string, action EncryptionAction) Option {
7853
return func(c *ClientConfig) {
79-
if c.Encryption.SpecificActions == nil {
80-
c.Encryption.SpecificActions = make(map[string]EncryptionAction)
81-
}
8254
c.Encryption.SpecificActions[attributeName] = action
8355
}
8456
}
57+
58+
// EncryptedClientOption defines a function signature for options that modify an EncryptedClient.
59+
type EncryptedClientOption func(*EncryptedClient)
60+
61+
// WithClientConfig sets the EncryptedClient's configuration.
62+
func WithClientConfig(config *ClientConfig) EncryptedClientOption {
63+
return func(ec *EncryptedClient) {
64+
ec.ClientConfig = config
65+
}
66+
}

0 commit comments

Comments
 (0)