Skip to content

Commit 02a895f

Browse files
rishav-karanjitrishav-karanjit
committed
auto commit
1 parent 14fdbc4 commit 02a895f

File tree

4 files changed

+123
-26
lines changed

4 files changed

+123
-26
lines changed

‎Examples/runtimes/go/migration/PlaintextToAWSDBE/awsdbe/migrationexamplestep1.go

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package awsdbe
33
import (
44
"context"
55
"fmt"
6-
"reflect"
76

87
"github.com/aws/aws-sdk-go-v2/aws"
98
"github.com/aws/aws-sdk-go-v2/config"
@@ -36,7 +35,7 @@ primary key configuration:
3635
- Partition key is named "partition_key" with type (S)
3736
- Sort key is named "sort_key" with type (S)
3837
*/
39-
func MigrationStep1(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue string) {
38+
func MigrationStep1(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyReadValue string) error {
4039
cfg, err := config.LoadDefaultConfig(context.TODO())
4140
utils.HandleError(err)
4241

@@ -66,10 +65,11 @@ func MigrationStep1(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
6665

6766
// 3. Put an item into your table.
6867
// This item will be stored in plaintext.
68+
encryptedAndSignedValue := "this will be encrypted and signed"
6969
item := map[string]types.AttributeValue{
7070
"partition_key": &types.AttributeValueMemberS{Value: partitionKeyValue},
71-
"sort_key": &types.AttributeValueMemberN{Value: sortKeyValue},
72-
"attribute1": &types.AttributeValueMemberS{Value: "this will be encrypted and signed"},
71+
"sort_key": &types.AttributeValueMemberN{Value: "1"},
72+
"attribute1": &types.AttributeValueMemberS{Value: encryptedAndSignedValue},
7373
"attribute2": &types.AttributeValueMemberS{Value: "this will never be encrypted, but it will be signed"},
7474
"attribute3": &types.AttributeValueMemberS{Value: "this will never be encrypted nor signed"},
7575
}
@@ -80,7 +80,12 @@ func MigrationStep1(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
8080
}
8181

8282
_, err = ddb.PutItem(context.TODO(), &putInput)
83-
utils.HandleError(err)
83+
84+
// We return this error because we run test against the error.
85+
// When used in production code, you can decide how you can to handle errors.
86+
if err != nil {
87+
return err
88+
}
8489

8590
// 4. Get an item back from the table using the DynamoDb Client.
8691
// If this is an item written in plaintext (i.e. any item written
@@ -90,7 +95,7 @@ func MigrationStep1(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
9095
// and surfaced as a plaintext item.
9196
key := map[string]types.AttributeValue{
9297
"partition_key": &types.AttributeValueMemberS{Value: partitionKeyValue},
93-
"sort_key": &types.AttributeValueMemberN{Value: sortKeyValue},
98+
"sort_key": &types.AttributeValueMemberN{Value: sortKeyReadValue},
9499
}
95100

96101
getInput := &dynamodb.GetItemInput{
@@ -100,11 +105,19 @@ func MigrationStep1(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
100105
}
101106

102107
result, err := ddb.GetItem(context.TODO(), getInput)
103-
utils.HandleError(err)
108+
// We return this error because we run test against the error.
109+
// When used in production code, you can decide how you can to handle errors.
110+
if err != nil {
111+
return err
112+
}
104113

105114
// Verify we got the expected item back
106-
if !reflect.DeepEqual(item, result.Item) {
115+
if partitionKeyValue != result.Item["partition_key"].(*types.AttributeValueMemberS).Value {
116+
panic("Decrypted item does not match original item")
117+
}
118+
if encryptedAndSignedValue != result.Item["attribute1"].(*types.AttributeValueMemberS).Value {
107119
panic("Decrypted item does not match original item")
108120
}
109121
fmt.Println("MigrationStep1 completed successfully")
122+
return nil
110123
}

‎Examples/runtimes/go/migration/PlaintextToAWSDBE/awsdbe/migrationexamplestep2.go

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
// Standard imports
55
"context"
66
"fmt"
7-
"reflect"
87

98
// AWS SDK imports
109

@@ -38,7 +37,7 @@ primary key configuration:
3837
- Partition key is named "partition_key" with type (S)
3938
- Sort key is named "sort_key" with type (S)
4039
*/
41-
func MigrationStep2(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue string) {
40+
func MigrationStep2(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyReadValue string) error {
4241
cfg, err := config.LoadDefaultConfig(context.TODO())
4342
utils.HandleError(err)
4443

@@ -64,10 +63,11 @@ func MigrationStep2(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
6463

6564
// 6. Put an item into your table.
6665
// This item will be encrypted.
66+
encryptedAndSignedValue := "this will be encrypted and signed"
6767
item := map[string]types.AttributeValue{
6868
"partition_key": &types.AttributeValueMemberS{Value: partitionKeyValue},
69-
"sort_key": &types.AttributeValueMemberN{Value: sortKeyValue},
70-
"attribute1": &types.AttributeValueMemberS{Value: "this will be encrypted and signed"},
69+
"sort_key": &types.AttributeValueMemberN{Value: "2"},
70+
"attribute1": &types.AttributeValueMemberS{Value: encryptedAndSignedValue},
7171
"attribute2": &types.AttributeValueMemberS{Value: "this will never be encrypted, but it will be signed"},
7272
"attribute3": &types.AttributeValueMemberS{Value: "this will never be encrypted nor signed"},
7373
}
@@ -78,7 +78,12 @@ func MigrationStep2(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
7878
}
7979

8080
_, err = ddb.PutItem(context.TODO(), &putInput)
81-
utils.HandleError(err)
81+
82+
// We return this error because we run test against the error.
83+
// When used in production code, you can decide how you can to handle errors.
84+
if err != nil {
85+
return err
86+
}
8287

8388
// 7. Get an item back from the table.
8489
// If this is an item written in plaintext (i.e. any item written
@@ -88,7 +93,7 @@ func MigrationStep2(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
8893
// item client-sid and surface it in our code as a plaintext item.
8994
key := map[string]types.AttributeValue{
9095
"partition_key": &types.AttributeValueMemberS{Value: partitionKeyValue},
91-
"sort_key": &types.AttributeValueMemberN{Value: sortKeyValue},
96+
"sort_key": &types.AttributeValueMemberN{Value: sortKeyReadValue},
9297
}
9398

9499
getInput := &dynamodb.GetItemInput{
@@ -98,11 +103,19 @@ func MigrationStep2(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
98103
}
99104

100105
result, err := ddb.GetItem(context.TODO(), getInput)
101-
utils.HandleError(err)
106+
// We return this error because we run test against the error.
107+
// When used in production code, you can decide how you can to handle errors.
108+
if err != nil {
109+
return err
110+
}
102111

103-
// Demonstrate we get the expected item back
104-
if !reflect.DeepEqual(item, result.Item) {
112+
// Verify we got the expected item back
113+
if partitionKeyValue != result.Item["partition_key"].(*types.AttributeValueMemberS).Value {
114+
panic("Decrypted item does not match original item")
115+
}
116+
if encryptedAndSignedValue != result.Item["attribute1"].(*types.AttributeValueMemberS).Value {
105117
panic("Decrypted item does not match original item")
106118
}
107119
fmt.Println("MigrationStep2 completed successfully")
120+
return nil
108121
}

‎Examples/runtimes/go/migration/PlaintextToAWSDBE/awsdbe/migrationexamplestep3.go

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
// Standard imports
55
"context"
66
"fmt"
7-
"reflect"
87

98
// AWS SDK imports
109

@@ -34,7 +33,7 @@ primary key configuration:
3433
- Partition key is named "partition_key" with type (S)
3534
- Sort key is named "sort_key" with type (S)
3635
*/
37-
func MigrationStep3(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue string) {
36+
func MigrationStep3(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyReadValue string) error {
3837
cfg, err := config.LoadDefaultConfig(context.TODO())
3938
utils.HandleError(err)
4039

@@ -63,10 +62,11 @@ func MigrationStep3(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
6362

6463
// 6. Put an item into your table.
6564
// This item will be encrypted.
65+
encryptedAndSignedValue := "this will be encrypted and signed"
6666
item := map[string]types.AttributeValue{
6767
"partition_key": &types.AttributeValueMemberS{Value: partitionKeyValue},
68-
"sort_key": &types.AttributeValueMemberN{Value: sortKeyValue},
69-
"attribute1": &types.AttributeValueMemberS{Value: "this will be encrypted and signed"},
68+
"sort_key": &types.AttributeValueMemberN{Value: "3"},
69+
"attribute1": &types.AttributeValueMemberS{Value: encryptedAndSignedValue},
7070
"attribute2": &types.AttributeValueMemberS{Value: "this will never be encrypted, but it will be signed"},
7171
"attribute3": &types.AttributeValueMemberS{Value: "this will never be encrypted nor signed"},
7272
}
@@ -77,7 +77,11 @@ func MigrationStep3(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
7777
}
7878

7979
_, err = ddb.PutItem(context.TODO(), &putInput)
80-
utils.HandleError(err)
80+
// We return this error because we run test against the error.
81+
// When used in production code, you can decide how you can to handle errors.
82+
if err != nil {
83+
return err
84+
}
8185

8286
// 7. Get an item back from the table.
8387
// If this is an item written in plaintext (i.e. any item written
@@ -87,7 +91,7 @@ func MigrationStep3(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
8791
// item client-sid and surface it in our code as a plaintext item.
8892
key := map[string]types.AttributeValue{
8993
"partition_key": &types.AttributeValueMemberS{Value: partitionKeyValue},
90-
"sort_key": &types.AttributeValueMemberN{Value: sortKeyValue},
94+
"sort_key": &types.AttributeValueMemberN{Value: sortKeyReadValue},
9195
}
9296

9397
getInput := &dynamodb.GetItemInput{
@@ -97,11 +101,20 @@ func MigrationStep3(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue stri
97101
}
98102

99103
result, err := ddb.GetItem(context.TODO(), getInput)
100-
utils.HandleError(err)
104+
// We return this error because we run test against the error.
105+
// When used in production code, you can decide how you can to handle errors.
106+
if err != nil {
107+
return err
108+
}
101109

102-
// Demonstrate we get the expected item back
103-
if !reflect.DeepEqual(item, result.Item) {
110+
// Verify we got the expected item back
111+
if partitionKeyValue != result.Item["partition_key"].(*types.AttributeValueMemberS).Value {
112+
panic("Decrypted item does not match original item")
113+
}
114+
if encryptedAndSignedValue != result.Item["attribute1"].(*types.AttributeValueMemberS).Value {
104115
panic("Decrypted item does not match original item")
105116
}
106117
fmt.Println("MigrationStep3 completed successfully")
118+
119+
return nil
107120
}

‎Examples/runtimes/go/migration/PlaintextToAWSDBE/awsdbe/migrationexamplestep3_test.go

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
package awsdbe
2+
3+
import (
4+
"errors"
5+
"strings"
6+
"testing"
7+
8+
"github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/examples/migration/PlaintextToAWSDBE/plaintext"
9+
"github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/examples/utils"
10+
"github.com/aws/smithy-go"
11+
"github.com/google/uuid"
12+
)
13+
14+
func TestMigrationStep3(t *testing.T) {
15+
kmsKeyID := utils.KmsKeyID()
16+
tableName := utils.DdbTableName()
17+
partitionKey := uuid.New().String()
18+
sortKeys := []string{"0", "1", "2", "3"}
19+
20+
// Successfully executes Step 3
21+
MigrationStep3(kmsKeyID, tableName, partitionKey, sortKeys[3])
22+
23+
// Given: Step 0 has succeeded
24+
plaintext.MigrationStep0(tableName, partitionKey, sortKeys[0])
25+
// When: Execute Step 3 with sortReadValue=0, Then: should panic (cannot read plaintext values)
26+
// MigrationStep3(kmsKeyID, tableName, partitionKey, sortKeys[0])
27+
assertError(MigrationStep3(kmsKeyID, tableName, partitionKey, sortKeys[0]))
28+
29+
// Given: Step 1 has succeeded
30+
MigrationStep1(kmsKeyID, tableName, partitionKey, sortKeys[1])
31+
// When: Execute Step 3 with sortReadValue=1, Then: should panic (cannot read plaintext values)
32+
assertError(MigrationStep3(kmsKeyID, tableName, partitionKey, sortKeys[1]))
33+
34+
// Given: Step 2 has succeeded
35+
MigrationStep2(kmsKeyID, tableName, partitionKey, sortKeys[2])
36+
// When: Execute Step 3 with sortReadValue=2, Then: Success (can read encrypted values)
37+
MigrationStep3(kmsKeyID, tableName, partitionKey, sortKeys[2])
38+
39+
// Cleanup
40+
for _, sortKey := range sortKeys {
41+
utils.DeleteItem(tableName, "partition_key", partitionKey, "sort_key", sortKey)
42+
}
43+
}
44+
45+
func assertError(err error) {
46+
var oe *smithy.OperationError
47+
if errors.As(err, &oe) {
48+
if oe.Service() != "DynamoDB" {
49+
panic("Expected service to be DynamoDB")
50+
}
51+
if oe.Operation() != "GetItem" {
52+
panic("Expected Operation to be GetItem")
53+
}
54+
if !strings.Contains(oe.Unwrap().Error(), "Encrypted item missing expected header and footer attributes") {
55+
panic("Expected message to contain Encrypted item missing expected header and footer attributes")
56+
}
57+
}
58+
}

0 commit comments

Comments
 (0)