auto commit

Author: rishav-karanjit

Examples/runtimes/go/migration/PlaintextToAWSDBE/awsdbe/migrationexamplestep2.go

@@ -0,0 +1,106 @@
+package awsdbe
+
+import (
+	// Standard imports
+	"context"
+	"reflect"
+
+	// AWS SDK imports
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
+
+	dbesdkdynamodbencryptiontypes "github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/awscryptographydbencryptionsdkdynamodbsmithygeneratedtypes"
+	"github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/dbesdkmiddleware"
+	"github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/examples/utils"
+)
+
+/*
+Migration Step 2: This is an example demonstrating how to update your configuration
+to start writing encrypted items, but still continue to read any plaintext or
+encrypted items.
+
+Once you deploy this change to your system, you will have a dataset
+containing both encrypted and plaintext items.
+Because the changes in Step 1 have been deployed to all our readers,
+we can be sure that our entire system is ready to read this new data.
+
+Before you move onto the next step, you will need to encrypt all plaintext items in your dataset.
+How you will want to do this depends on your system.
+
+Running this example requires access to the DDB Table whose name
+is provided in CLI arguments.
+This table must be configured with the following
+primary key configuration:
+  - Partition key is named "partition_key" with type (S)
+  - Sort key is named "sort_key" with type (S)
+*/
+func MigrationStep2(kmsKeyID, ddbTableName, partitionKeyValue, sortKeyValue string) {
+	cfg, err := config.LoadDefaultConfig(context.TODO())
+	utils.HandleError(err)
+
+	// 1. Configure your Keyring, attribute actions,
+	// 	  allowedUnsignedAttributes, and encryption configuration for table.
+	//    This is common across all the steps.
+
+	// When creating encryption configuration for your table,
+	// you must use the plaintext override `FORBID_PLAINTEXT_WRITE_ALLOW_PLAINTEXT_READ`.
+	// This plaintext override means:
+	// 	- Write: Items are forbidden to be written as plaintext.
+	//  	Items will be written as encrypted items.
+	//  - Read: Items are allowed to be read as plaintext.
+	//  	Items are allowed to be read as encrypted items.
+
+	listOfTableConfigs := configureTable(kmsKeyID, ddbTableName, dbesdkdynamodbencryptiontypes.PlaintextOverrideForbidPlaintextWriteAllowPlaintextRead)
+
+	// 5. Create DynamoDB client with dbEsdkMiddleware
+	dbEsdkMiddleware, err := dbesdkmiddleware.NewDBEsdkMiddleware(listOfTableConfigs)
+	utils.HandleError(err)
+
+	ddb := dynamodb.NewFromConfig(cfg, dbEsdkMiddleware.CreateMiddleware())
+
+	// 6. Put an item into your table.
+	//    This item will be encrypted.
+	item := map[string]types.AttributeValue{
+		"partition_key": &types.AttributeValueMemberS{Value: partitionKeyValue},
+		"sort_key":      &types.AttributeValueMemberN{Value: sortKeyValue},
+		"attribute1":    &types.AttributeValueMemberS{Value: "this will be encrypted and signed"},
+		"attribute2":    &types.AttributeValueMemberS{Value: "this will never be encrypted, but it will be signed"},
+		"attribute3":    &types.AttributeValueMemberS{Value: "this will never be encrypted nor signed"},
+	}
+
+	putInput := dynamodb.PutItemInput{
+		TableName: &ddbTableName,
+		Item:      item,
+	}
+
+	_, err = ddb.PutItem(context.TODO(), &putInput)
+	utils.HandleError(err)
+
+	// 7. Get an item back from the table.
+	//    If this is an item written in plaintext (i.e. any item written
+	//    during Step 0 or 1), then the item will still be in plaintext.
+	//    If this is an item that was encrypted client-side (i.e. any item written
+	//    during Step 2 or after), then the DDB enhanced client will decrypt the
+	//    item client-sid and surface it in our code as a plaintext item.
+	key := map[string]types.AttributeValue{
+		"partition_key": &types.AttributeValueMemberS{Value: partitionKeyValue},
+		"sort_key":      &types.AttributeValueMemberN{Value: sortKeyValue},
+	}
+
+	getInput := &dynamodb.GetItemInput{
+		TableName:      aws.String(ddbTableName),
+		Key:            key,
+		ConsistentRead: aws.Bool(true),
+	}
+
+	result, err := ddb.GetItem(context.TODO(), getInput)
+	utils.HandleError(err)
+
+	// Demonstrate we get the expected item back
+	if !reflect.DeepEqual(item, result.Item) {
+		panic("Decrypted item does not match original item")
+	}
+}