Skip to content

Commit e93fac1

Browse files
rishav-karanjitrishav-karanjit
committed
Merge branch 'rishav/go/ddb-nameChange' of https://github.com/aws/aws-database-encryption-sdk-dynamodb into rishav/go/ddb-nameChange
2 parents f78168f + 1e68f0d commit e93fac1

File tree

14 files changed

+155
-17
lines changed

14 files changed

+155
-17
lines changed

‎CHANGELOG.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,26 @@
11
# Changelog
22

3+
## [3.9.0](https://github.com/aws/aws-database-encryption-sdk-dynamodb/compare/v3.8.1...v3.9.0) (2025-06-25)
4+
5+
This release is available in the following languages:
6+
7+
- Java
8+
9+
### Maintenance
10+
11+
- **dafny:** Add ExecuteStatement test ([#1932](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1932)) ([66a19ab](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/66a19ab7d9ddea1018cbb01da053020148e4a1e7))
12+
- **dafny:** Add Update and delete test ([#1942](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1942)) ([3bd48ba](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/3bd48bacc6e9ca458931031062ee97f351f9de32))
13+
- **dafny:** change nat to uint64 in many places ([#1852](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1852)) ([ec22b7d](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/ec22b7d316678f4d836837e751bdfcf41f461441))
14+
- **dafny:** further performance enhancements ([#1834](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1834)) ([ea94693](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/ea9469327109a61e544425479dfb2c6be514ce5a))
15+
- **dafny:** improve performance ([#1900](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1900)) ([ccf61d6](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/ccf61d6a9c49385f1cccde0cda9c0609ba050455))
16+
- **dafny:** improve performance of searchable encryption ([#1931](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1931)) ([8b71004](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/8b710042e1bc0516b70a9f9674edab7f775d236f))
17+
- **dafny:** reduce use of BigInteger ([#1872](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1872)) ([eb7679a](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/eb7679afa9fb6383a76fd71f9e7a4e40bbe53c8a))
18+
- **dafny:** test ExecuteTransaction and BatchExecuteStatement ([#1941](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1941)) ([69c37c6](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/69c37c6a8491b2a5aadf74c4f80355b0593aed32))
19+
- **deps:** Bump MPL version to 1.11.0 ([#1945](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1945)) ([efdd373](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/efdd373ab91fc7465be0f0d05d8018f59131ee6f))
20+
- further performance improvements ([#1826](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1826)) ([3194054](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/3194054eea95c640d0ac469911e950fc76953dd6))
21+
- improve performance ([#1622](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1622)) ([8ca2883](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/8ca288345fe7371711c1c51e1d064538686e25f1))
22+
- update README for missing info ([#1939](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1939)) ([354f4f6](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/354f4f6c48ed6c60914f5ce0feaba64de7ed2587))
23+
324
## [3.8.1](https://github.com/aws/aws-database-encryption-sdk-dynamodb/compare/v3.8.0...v3.8.1) (2025-04-01)
425

526
This release is available in the following languages:

‎DynamoDbEncryption/runtimes/java/build.gradle.kts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,8 +250,8 @@ nexusPublishing {
250250
// https://github.com/gradle-nexus/publish-plugin/
251251
repositories {
252252
sonatype {
253-
nexusUrl.set(uri("https://aws.oss.sonatype.org/service/local/"))
254-
snapshotRepositoryUrl.set(uri("https://aws.oss.sonatype.org/content/repositories/snapshots/"))
253+
nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
254+
snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
255255
username.set(System.getenv("SONA_USERNAME"))
256256
password.set(System.getenv("SONA_PASSWORD"))
257257
}

‎DynamoDbEncryption/runtimes/net/AssemblyInfo.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@
33
[assembly: AssemblyTitle("AWS.Cryptography.DbEncryptionSDK.DynamoDb")]
44

55
// This should be kept in sync with the version number in MPL.csproj
6-
[assembly: AssemblyVersion("3.8.1")]
6+
[assembly: AssemblyVersion("3.9.0")]
77

‎DynamoDbEncryption/runtimes/net/DynamoDbEncryption.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
66
<IsPackable>true</IsPackable>
77

8-
<Version>3.8.1</Version>
8+
<Version>3.9.0</Version>
99

1010
<AssemblyName>AWS.Cryptography.DbEncryptionSDK.DynamoDb</AssemblyName>
1111
<PackageId>AWS.Cryptography.DbEncryptionSDK.DynamoDb</PackageId>

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ format_java_misc-check: setup_prettier
5151
npx prettier --plugin=prettier-plugin-java . --check
5252

5353
setup_prettier:
54-
npm i --no-save prettier@3 [email protected]
54+
npm i --no-save prettier@3.5.3 [email protected]
5555

5656
# Generate the top-level project.properties file using smithy-dafny.
5757
# This is for the benefit of the nightly Dafny CI,

‎TestVectors/dafny/DDBEncryption/src/TestVectors.dfy

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,12 @@ module {:options "-functionSyntax:4"} DdbEncryptionTestVectors {
397397
BasicIoTestBatchWriteItem(c1, c2, globalRecords);
398398
BasicIoTestPutItem(c1, c2, globalRecords);
399399
BasicIoTestTransactWriteItems(c1, c2, globalRecords);
400+
BasicIoTestUpdateItem(c1, c2, globalRecords, "One");
401+
BasicIoTestUpdateItem(c1, c2, globalRecords, "Two");
402+
BasicIoTestDeleteItem(c1, c2, globalRecords, "One", "Uno");
403+
BasicIoTestDeleteItem(c1, c2, globalRecords, "Two", "Dos");
404+
BasicIoTestDeleteItemWithoutConditionExpression(c1, c2, globalRecords, "One", "Uno");
405+
BasicIoTestDeleteItemWithoutConditionExpression(c1, c2, globalRecords, "Two", "Dos");
400406
BasicIoTestExecuteStatement(c1, c2);
401407
BasicIoTestExecuteTransaction(c1, c2);
402408
BasicIoTestBatchExecuteStatement(c1, c2);
@@ -844,6 +850,108 @@ module {:options "-functionSyntax:4"} DdbEncryptionTestVectors {
844850
BasicIoTestTransactGetItems(rClient, records);
845851
}
846852

853+
method BasicIoTestUpdateItem(writeConfig : TableConfig, readConfig : TableConfig, records : seq<Record>, attributeToUpdate: DDB.AttributeName)
854+
{
855+
var wClient, rClient := SetupTestTable(writeConfig, readConfig);
856+
WriteAllRecords(wClient, records);
857+
// Update each record by appending "updated" to the partition key
858+
for i := 0 to |records| {
859+
var newValue := "updated";
860+
// Create an update expression to update the partition key
861+
var updateExpr := "SET #att = :val";
862+
expect attributeToUpdate in writeConfig.config.attributeActionsOnEncrypt, "`attributeToUpdate` not in attributeActionsOnEncrypt";
863+
var exprAttrNames := map["#att" := attributeToUpdate];
864+
var exprAttrValues := map[":val" := DDB.AttributeValue.S(newValue)];
865+
expect HashName in records[i].item, "`HashName` is not in records.";
866+
var updateInput := DDB.UpdateItemInput(
867+
TableName := TableName,
868+
Key := map[HashName := records[i].item[HashName]],
869+
UpdateExpression := Some(updateExpr),
870+
ExpressionAttributeNames := Some(exprAttrNames),
871+
ExpressionAttributeValues := Some(exprAttrValues),
872+
ReturnValues := None,
873+
ReturnConsumedCapacity := None,
874+
ReturnItemCollectionMetrics := None,
875+
ConditionExpression := None
876+
);
877+
var updateResult := wClient.UpdateItem(updateInput);
878+
if writeConfig.config.attributeActionsOnEncrypt[attributeToUpdate] == SE.ENCRYPT_AND_SIGN || writeConfig.config.attributeActionsOnEncrypt[attributeToUpdate] == SE.SIGN_ONLY {
879+
expect updateResult.Failure?, "UpdateItem should have failed for signed item.";
880+
// This error is of type DynamoDbEncryptionTransformsException
881+
// but AWS SDK wraps it into its own type for which customers should be unwrapping.
882+
// In test vectors, we still have to change the error from AWS SDK to dafny so it turns out to be OpaqueWithText.
883+
expect updateResult.error.OpaqueWithText?, "Error should have been of type OpaqueWithText";
884+
var hasDynamoDbEncryptionTransformsException? := String.HasSubString(updateResult.error.objMessage, "Update Expressions forbidden on signed attributes");
885+
expect hasDynamoDbEncryptionTransformsException?.Some?, "Error might is not be of type DynamoDbEncryptionTransformsException";
886+
} else {
887+
expect updateResult.Success?;
888+
}
889+
}
890+
}
891+
892+
method BasicIoTestDeleteItem(writeConfig : TableConfig, readConfig : TableConfig, records : seq<Record>, attributeToDelete: DDB.AttributeName, expectedAttributeValue: string)
893+
{
894+
var wClient, rClient := SetupTestTable(writeConfig, readConfig);
895+
WriteAllRecords(wClient, records);
896+
// Try to delete records with a condition expression with condition to
897+
// delete records if the record has an attribute attributeToDelete with value expectedAttributeValue
898+
for i := 0 to |records| {
899+
// Set up condition expression to only delete if Two = expectedAttributeValue
900+
var conditionExpr := "#attr = :val";
901+
var exprAttrNames := map["#attr" := attributeToDelete];
902+
var exprAttrValues := map[":val" := DDB.AttributeValue.S(expectedAttributeValue)];
903+
expect HashName in records[i].item, "`HashName` is not in records.";
904+
var deleteInput := DDB.DeleteItemInput(
905+
TableName := TableName,
906+
Key := map[HashName := records[i].item[HashName]],
907+
ConditionExpression := Some(conditionExpr),
908+
ExpressionAttributeNames := Some(exprAttrNames),
909+
ExpressionAttributeValues := Some(exprAttrValues),
910+
ReturnValues := Some(DDB.ReturnValue.ALL_OLD)
911+
);
912+
var deleteResult := wClient.DeleteItem(deleteInput);
913+
expect attributeToDelete in writeConfig.config.attributeActionsOnEncrypt, "`attributeToDelete` not found in attributeActionsOnEncrypt of config.";
914+
if writeConfig.config.attributeActionsOnEncrypt[attributeToDelete] == SE.ENCRYPT_AND_SIGN {
915+
expect deleteResult.Failure?, "DeleteItem should have failed.";
916+
// This error is of type DynamoDbEncryptionTransformsException
917+
// but AWS SDK wraps it into its own type for which customers should be unwrapping.
918+
// In test vectors, we still have to change the error from AWS SDK to dafny so it turns out to be OpaqueWithText.
919+
expect deleteResult.error.OpaqueWithText?, "Error should have been of type OpaqueWithText";
920+
var hasDynamoDbEncryptionTransformsException? := String.HasSubString(deleteResult.error.objMessage, "Condition Expressions forbidden on encrypted attributes");
921+
expect hasDynamoDbEncryptionTransformsException?.Some?, "Error might is not be of type DynamoDbEncryptionTransformsException";
922+
} else if attributeToDelete in records[i].item && records[i].item[attributeToDelete].S? && records[i].item[attributeToDelete].S == expectedAttributeValue {
923+
expect deleteResult.Success?, "DeleteItem should have succeeded.";
924+
expect deleteResult.value.Attributes.Some?, "DeleteItemOutput should have had some attribute because ReturnValues was set as `ALL_OLD` in DeleteItemInput";
925+
expect HashName in deleteResult.value.Attributes.value, "Deleted item does not have right partition key:" + HashName;
926+
expect deleteResult.value.Attributes.value[HashName] == records[i].item[HashName], "Wrong item was deleted.";
927+
} else {
928+
expect deleteResult.Failure?, "DeleteItem should have failed.";
929+
expect deleteResult.error.ConditionalCheckFailedException?, "DeleteItem should have failed with ConditionalCheckFailedException";
930+
}
931+
}
932+
}
933+
934+
method BasicIoTestDeleteItemWithoutConditionExpression(writeConfig : TableConfig, readConfig : TableConfig, records : seq<Record>, attributeToDelete: DDB.AttributeName, expectedAttributeValue: string)
935+
{
936+
var wClient, rClient := SetupTestTable(writeConfig, readConfig);
937+
WriteAllRecords(wClient, records);
938+
for i := 0 to |records| {
939+
expect HashName in records[i].item, "`HashName` is not in records.";
940+
var deleteInputWithoutConditionExpression := DDB.DeleteItemInput(
941+
TableName := TableName,
942+
Key := map[HashName := records[i].item[HashName]],
943+
ReturnValues := Some(DDB.ReturnValue.ALL_OLD)
944+
);
945+
var deleteResultForWithoutConditionExpressionCase := wClient.DeleteItem(deleteInputWithoutConditionExpression);
946+
expect deleteResultForWithoutConditionExpressionCase.Success?, "DeleteItem should have succeeded.";
947+
expect deleteResultForWithoutConditionExpressionCase.value.Attributes.Some?, "DeleteItemOutput should have had some attribute because ReturnValues was set as `ALL_OLD` in DeleteItemInput";
948+
if attributeToDelete in records[i].item {
949+
expect HashName in deleteResultForWithoutConditionExpressionCase.value.Attributes.value, "Deleted item does not have right partition key:" + HashName;
950+
expect deleteResultForWithoutConditionExpressionCase.value.Attributes.value[HashName] == records[i].item[HashName], "Wrong item was deleted.";
951+
}
952+
}
953+
}
954+
847955
method BasicIoTestExecuteStatement(writeConfig : TableConfig, readConfig : TableConfig)
848956
{
849957
var wClient, rClient := SetupTestTable(writeConfig, readConfig);

‎cfn/CB-Staging.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ Resources:
5555
Type: NO_CACHE
5656
Environment:
5757
ComputeType: BUILD_GENERAL1_LARGE
58-
Image: "aws/codebuild/standard:5.0"
58+
Image: "aws/codebuild/standard:6.0"
5959
ImagePullCredentialsType: CODEBUILD
6060
PrivilegedMode: true
6161
Type: LINUX_CONTAINER
@@ -239,6 +239,7 @@ Resources:
239239
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Maven-GPG-Keys-Release-haLIjZ",
240240
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Maven-GPG-Keys-Release-Credentials-WgJanS",
241241
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Sonatype-User-Token-zK61bM",
242+
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Sonatype-Central-Portal-XrYUs2",
242243
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Github/aws-crypto-tools-ci-bot-AGUB3U"
243244
],
244245
"Action": "secretsmanager:GetSecretValue"

‎codebuild/release/release-prod.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,14 @@ env:
99
secrets-manager:
1010
GPG_KEY: Maven-GPG-Keys-Release-Credentials:Keyname
1111
GPG_PASS: Maven-GPG-Keys-Release-Credentials:Passphrase
12-
SONA_USERNAME: Sonatype-User-Token:username
13-
SONA_PASSWORD: Sonatype-User-Token:password
12+
SONA_USERNAME: Sonatype-Central-Portal:Username
13+
SONA_PASSWORD: Sonatype-Central-Portal:Password
1414

1515
phases:
1616
install:
1717
runtime-versions:
1818
java: corretto8
19+
dotnet: 6.0
1920
commands:
2021
- cd ..
2122
# Get Dafny
@@ -27,6 +28,7 @@ phases:
2728
- unzip -qq gradle.zip && rm gradle.zip
2829
- export PATH="$PWD/gradle-7.6/bin:$PATH"
2930
- cd aws-database-encryption-sdk-dynamodb/
31+
- make -C submodules/MaterialProviders/StandardLibrary setup_net
3032
pre_build:
3133
commands:
3234
- aws secretsmanager get-secret-value --region us-west-2 --secret-id Maven-GPG-Keys-Release --query SecretBinary --output text | base64 -d > ~/mvn_gpg.tgz

‎codebuild/release/release.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ batch:
1313
variables:
1414
JAVA_ENV_VERSION: corretto8
1515
JAVA_NUMERIC_VERSION: 8
16-
image: aws/codebuild/standard:5.0
16+
image: aws/codebuild/standard:6.0
1717

1818
- identifier: validate_staging_corretto8
1919
depend-on:
@@ -23,7 +23,7 @@ batch:
2323
variables:
2424
JAVA_ENV_VERSION: corretto8
2525
JAVA_NUMERIC_VERSION: 8
26-
image: aws/codebuild/standard:5.0
26+
image: aws/codebuild/standard:6.0
2727

2828
- identifier: validate_staging_corretto11
2929
depend-on:
@@ -33,7 +33,7 @@ batch:
3333
variables:
3434
JAVA_ENV_VERSION: corretto11
3535
JAVA_NUMERIC_VERSION: 11
36-
image: aws/codebuild/standard:5.0
36+
image: aws/codebuild/standard:6.0
3737

3838
- identifier: validate_staging_corretto17
3939
depend-on:
@@ -55,7 +55,7 @@ batch:
5555
variables:
5656
JAVA_ENV_VERSION: corretto8
5757
JAVA_NUMERIC_VERSION: 8
58-
image: aws/codebuild/standard:5.0
58+
image: aws/codebuild/standard:6.0
5959

6060
## The following steps are expected to fail; since maven central takes time to
6161
## update its index. For now, a manual download of the jar is needed to assert artifacts are
@@ -68,7 +68,7 @@ batch:
6868
variables:
6969
JAVA_ENV_VERSION: corretto8
7070
JAVA_NUMERIC_VERSION: 8
71-
image: aws/codebuild/standard:5.0
71+
image: aws/codebuild/standard:6.0
7272

7373
- identifier: validate_release_corretto11
7474
depend-on:
@@ -78,7 +78,7 @@ batch:
7878
variables:
7979
JAVA_ENV_VERSION: corretto11
8080
JAVA_NUMERIC_VERSION: 11
81-
image: aws/codebuild/standard:5.0
81+
image: aws/codebuild/standard:6.0
8282

8383
- identifier: validate_release_corretto17
8484
depend-on:

‎codebuild/release/validate-release.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ phases:
1111
install:
1212
runtime-versions:
1313
java: $JAVA_ENV_VERSION
14+
dotnet: 6.0
1415
commands:
1516
- cd ..
1617
# Get Dafny
@@ -22,6 +23,7 @@ phases:
2223
- unzip -qq gradle.zip && rm gradle.zip
2324
- export PATH="$PWD/gradle-7.6/bin:$PATH"
2425
- cd aws-database-encryption-sdk-dynamodb/
26+
- make -C submodules/MaterialProviders/StandardLibrary setup_net
2527
pre_build:
2628
commands:
2729
# Get CI Creds to be able to call DBESDK TestVectors

0 commit comments

Comments
 (0)