Skip to content

Commit f0f7c54

Browse files
rishav-karanjitrishav-karanjit
committed
auto commit
1 parent 896d90c commit f0f7c54

File tree

4 files changed

+119
-188
lines changed

4 files changed

+119
-188
lines changed

‎Examples/runtimes/net/src/migration/PlaintextToAWSDBE/awsdbe/MigrationStep1.cs‎

Lines changed: 5 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -37,86 +37,13 @@ public class MigrationStep1
3737
{
3838
public static async Task<bool> MigrationStep1Example(string kmsKeyId, string ddbTableName, string partitionKeyValue, string sortKeyWriteValue, string sortKeyReadValue)
3939
{
40-
// 1. Create a Keyring. This Keyring will be responsible for protecting the data keys that protect your data.
41-
// For this example, we will create a AWS KMS Keyring with the AWS KMS Key we want to use.
42-
// We will use the `CreateMrkMultiKeyring` method to create this keyring,
43-
// as it will correctly handle both single region and Multi-Region KMS Keys.
44-
var matProv = new MaterialProviders(new MaterialProvidersConfig());
45-
var keyringInput = new CreateAwsKmsMrkMultiKeyringInput { Generator = kmsKeyId };
46-
var kmsKeyring = matProv.CreateAwsKmsMrkMultiKeyring(keyringInput);
40+
var tableConfigs = Common.CreateTableConfigs(kmsKeyId, ddbTableName, PlaintextOverride.FORCE_PLAINTEXT_WRITE_ALLOW_PLAINTEXT_READ);
4741

48-
// 2. Configure which attributes are encrypted and/or signed when writing new items.
49-
// For each attribute that may exist on the items we plan to write to our DynamoDbTable,
50-
// we must explicitly configure how they should be treated during item encryption:
51-
// - ENCRYPT_AND_SIGN: The attribute is encrypted and included in the signature
52-
// - SIGN_ONLY: The attribute not encrypted, but is still included in the signature
53-
// - DO_NOTHING: The attribute is not encrypted and not included in the signature
54-
var attributeActionsOnEncrypt = new Dictionary<string, CryptoAction>
55-
{
56-
["partition_key"] = CryptoAction.SIGN_ONLY, // Our partition attribute must be SIGN_ONLY
57-
["sort_key"] = CryptoAction.SIGN_ONLY, // Our sort attribute must be SIGN_ONLY
58-
["attribute1"] = CryptoAction.ENCRYPT_AND_SIGN,
59-
["attribute2"] = CryptoAction.SIGN_ONLY,
60-
["attribute3"] = CryptoAction.DO_NOTHING
61-
};
62-
63-
// 3. Configure which attributes we expect to be excluded in the signature
64-
// when reading items. There are two options for configuring this:
65-
//
66-
// - (Recommended) Configure `allowedUnsignedAttributesPrefix`:
67-
// When defining your DynamoDb schema and deciding on attribute names,
68-
// choose a distinguishing prefix (such as ":") for all attributes that
69-
// you do not want to include in the signature.
70-
// This has two main benefits:
71-
// - It is easier to reason about the security and authenticity of data within your item
72-
// when all unauthenticated data is easily distinguishable by their attribute name.
73-
// - If you need to add new unauthenticated attributes in the future,
74-
// you can easily make the corresponding update to your `attributeActionsOnEncrypt`
75-
// and immediately start writing to that new attribute, without
76-
// any other configuration update needed.
77-
// Once you configure this field, it is not safe to update it.
78-
//
79-
// - Configure `allowedUnsignedAttributes`: You may also explicitly list
80-
// a set of attributes that should be considered unauthenticated when encountered
81-
// on read. Be careful if you use this configuration. Do not remove an attribute
82-
// name from this configuration, even if you are no longer writing with that attribute,
83-
// as old items may still include this attribute, and our configuration needs to know
84-
// to continue to exclude this attribute from the signature scope.
85-
// If you add new attribute names to this field, you must first deploy the update to this
86-
// field to all readers in your host fleet before deploying the update to start writing
87-
// with that new attribute.
88-
//
89-
// For this example, we will explicitly list the attributes that are not signed.
90-
var unsignedAttributes = new List<string> { "attribute3" };
91-
92-
// 4. Create the DynamoDb Encryption configuration for the table we will be writing to.
93-
// This configuration uses PlaintextOverride.FORCE_PLAINTEXT_WRITE_ALLOW_PLAINTEXT_READ
94-
// which means:
95-
// - Write: Items are forced to be written as plaintext.
96-
// Items may not be written as encrypted items.
97-
// - Read: Items are allowed to be read as plaintext.
98-
// Items are allowed to be read as encrypted items.
99-
var tableConfig = new DynamoDbTableEncryptionConfig
100-
{
101-
LogicalTableName = ddbTableName,
102-
PartitionKeyName = "partition_key",
103-
SortKeyName = "sort_key",
104-
AttributeActionsOnEncrypt = attributeActionsOnEncrypt,
105-
Keyring = kmsKeyring,
106-
AllowedUnsignedAttributes = unsignedAttributes,
107-
PlaintextOverride = PlaintextOverride.FORCE_PLAINTEXT_WRITE_ALLOW_PLAINTEXT_READ
108-
};
109-
110-
var tableConfigs = new Dictionary<string, DynamoDbTableEncryptionConfig>
111-
{
112-
[ddbTableName] = tableConfig
113-
};
114-
115-
// 5. Create a new AWS SDK DynamoDb client using the TableEncryptionConfigs
42+
// 1. Create a new AWS SDK DynamoDb client using the TableEncryptionConfigs
11643
var ddb = new Client.DynamoDbClient(
11744
new DynamoDbTablesEncryptionConfig { TableEncryptionConfigs = tableConfigs });
11845

119-
// 6. Put an item into our table using the above client.
46+
// 2. Put an item into our table using the above client.
12047
// This item will be stored in plaintext due to our PlaintextOverride configuration.
12148
string encryptedAndSignedValue = MigrationUtils.ENCRYPTED_AND_SIGNED_VALUE;
12249
string signOnlyValue = MigrationUtils.SIGN_ONLY_VALUE;
@@ -139,7 +66,7 @@ public static async Task<bool> MigrationStep1Example(string kmsKeyId, string ddb
13966
var putResponse = await ddb.PutItemAsync(putRequest);
14067
Debug.Assert(putResponse.HttpStatusCode == HttpStatusCode.OK);
14168

142-
// 7. Get an item back from the table using the same client.
69+
// 3. Get an item back from the table using the same client.
14370
// If this is an item written in plaintext (i.e. any item written
14471
// during Step 0 or 1), then the item will still be in plaintext.
14572
// If this is an item that was encrypted client-side (i.e. any item written
@@ -164,7 +91,7 @@ public static async Task<bool> MigrationStep1Example(string kmsKeyId, string ddb
16491
var getResponse = await ddb.GetItemAsync(getRequest);
16592
Debug.Assert(getResponse.HttpStatusCode == HttpStatusCode.OK);
16693

167-
// 8. Verify we get the expected item back
94+
// 4. Verify we get the expected item back
16895
if (getResponse.Item == null)
16996
{
17097
throw new Exception("No item found");

‎Examples/runtimes/net/src/migration/PlaintextToAWSDBE/awsdbe/MigrationStep2.cs‎

Lines changed: 12 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -39,62 +39,20 @@ public class MigrationStep2
3939
{
4040
public static async Task<bool> MigrationStep2Example(string kmsKeyId, string ddbTableName, string partitionKeyValue, string sortKeyWriteValue, string sortKeyReadValue)
4141
{
42-
// 1. Create a Keyring. This Keyring will be responsible for protecting the data keys that protect your data.
43-
// For this example, we will create a AWS KMS Keyring with the AWS KMS Key we want to use.
44-
// We will use the `CreateMrkMultiKeyring` method to create this keyring,
45-
// as it will correctly handle both single region and Multi-Region KMS Keys.
46-
var matProv = new MaterialProviders(new MaterialProvidersConfig());
47-
var keyringInput = new CreateAwsKmsMrkMultiKeyringInput { Generator = kmsKeyId };
48-
var kmsKeyring = matProv.CreateAwsKmsMrkMultiKeyring(keyringInput);
42+
// 1. Create table configurations
43+
// In this of migration we will use PlaintextOverride.FORBID_PLAINTEXT_WRITE_ALLOW_PLAINTEXT_READ
44+
// which means:
45+
// - Write: Items are forbidden to be written as plaintext.
46+
// Items will be written as encrypted items.
47+
// - Read: Items are allowed to be read as plaintext.
48+
// Items are allowed to be read as encrypted items.
49+
var tableConfigs = Common.CreateTableConfigs(kmsKeyId, ddbTableName, PlaintextOverride.FORBID_PLAINTEXT_WRITE_ALLOW_PLAINTEXT_READ);
4950

50-
// 2. Configure which attributes are encrypted and/or signed when writing new items.
51-
// For each attribute that may exist on the items we plan to write to our DynamoDbTable,
52-
// we must explicitly configure how they should be treated during item encryption:
53-
// - ENCRYPT_AND_SIGN: The attribute is encrypted and included in the signature
54-
// - SIGN_ONLY: The attribute not encrypted, but is still included in the signature
55-
// - DO_NOTHING: The attribute is not encrypted and not included in the signature
56-
var attributeActionsOnEncrypt = new Dictionary<string, CryptoAction>
57-
{
58-
["partition_key"] = CryptoAction.SIGN_ONLY, // Our partition attribute must be SIGN_ONLY
59-
["sort_key"] = CryptoAction.SIGN_ONLY, // Our sort attribute must be SIGN_ONLY
60-
["attribute1"] = CryptoAction.ENCRYPT_AND_SIGN,
61-
["attribute2"] = CryptoAction.SIGN_ONLY,
62-
["attribute3"] = CryptoAction.DO_NOTHING
63-
};
64-
65-
// 3. Configure which attributes we expect to be excluded in the signature
66-
// when reading items.
67-
// For this example, we will explicitly list the attributes that are not signed.
68-
var unsignedAttributes = new List<string> { "attribute3" };
69-
70-
// 4. Create the DynamoDb Encryption configuration for the table we will be writing to.
71-
// This configuration uses PlaintextOverride.FORBID_PLAINTEXT_WRITE_ALLOW_PLAINTEXT_READ
72-
// which means:
73-
// - Write: Items are forbidden to be written as plaintext.
74-
// Items will be written as encrypted items.
75-
// - Read: Items are allowed to be read as plaintext.
76-
// Items are allowed to be read as encrypted items.
77-
var tableConfig = new DynamoDbTableEncryptionConfig
78-
{
79-
LogicalTableName = ddbTableName,
80-
PartitionKeyName = "partition_key",
81-
SortKeyName = "sort_key",
82-
AttributeActionsOnEncrypt = attributeActionsOnEncrypt,
83-
Keyring = kmsKeyring,
84-
AllowedUnsignedAttributes = unsignedAttributes,
85-
PlaintextOverride = PlaintextOverride.FORBID_PLAINTEXT_WRITE_ALLOW_PLAINTEXT_READ
86-
};
87-
88-
var tableConfigs = new Dictionary<string, DynamoDbTableEncryptionConfig>
89-
{
90-
[ddbTableName] = tableConfig
91-
};
92-
93-
// 5. Create a new AWS SDK DynamoDb client using the TableEncryptionConfigs
51+
// 2. Create a new AWS SDK DynamoDb client using the TableEncryptionConfigs
9452
var ddb = new Client.DynamoDbClient(
9553
new DynamoDbTablesEncryptionConfig { TableEncryptionConfigs = tableConfigs });
9654

97-
// 6. Put an item into our table using the above client.
55+
// 3. Put an item into our table using the above client.
9856
// This item will be encrypted due to our PlaintextOverride configuration.
9957
string encryptedAndSignedValue = MigrationUtils.ENCRYPTED_AND_SIGNED_VALUE;
10058
string signOnlyValue = MigrationUtils.SIGN_ONLY_VALUE;
@@ -117,7 +75,7 @@ public static async Task<bool> MigrationStep2Example(string kmsKeyId, string ddb
11775
var putResponse = await ddb.PutItemAsync(putRequest);
11876
Debug.Assert(putResponse.HttpStatusCode == HttpStatusCode.OK);
11977

120-
// 7. Get an item back from the table using the same client.
78+
// 4. Get an item back from the table using the same client.
12179
// If this is an item written in plaintext (i.e. any item written
12280
// during Step 0 or 1), then the item will still be in plaintext.
12381
// If this is an item that was encrypted client-side (i.e. any item written
@@ -142,7 +100,7 @@ public static async Task<bool> MigrationStep2Example(string kmsKeyId, string ddb
142100
var getResponse = await ddb.GetItemAsync(getRequest);
143101
Debug.Assert(getResponse.HttpStatusCode == HttpStatusCode.OK);
144102

145-
// 8. Verify we get the expected item back
103+
// 5. Verify we get the expected item back
146104
if (getResponse.Item == null)
147105
{
148106
throw new Exception("No item found");

‎Examples/runtimes/net/src/migration/PlaintextToAWSDBE/awsdbe/MigrationStep3.cs‎

Lines changed: 14 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -36,65 +36,23 @@ public class MigrationStep3
3636
{
3737
public static async Task<bool> MigrationStep3Example(string kmsKeyId, string ddbTableName, string partitionKeyValue, string sortKeyWriteValue, string sortKeyReadValue)
3838
{
39-
// 1. Create a Keyring. This Keyring will be responsible for protecting the data keys that protect your data.
40-
// For this example, we will create a AWS KMS Keyring with the AWS KMS Key we want to use.
41-
// We will use the `CreateMrkMultiKeyring` method to create this keyring,
42-
// as it will correctly handle both single region and Multi-Region KMS Keys.
43-
var matProv = new MaterialProviders(new MaterialProvidersConfig());
44-
var keyringInput = new CreateAwsKmsMrkMultiKeyringInput { Generator = kmsKeyId };
45-
var kmsKeyring = matProv.CreateAwsKmsMrkMultiKeyring(keyringInput);
46-
47-
// 2. Configure which attributes are encrypted and/or signed when writing new items.
48-
// For each attribute that may exist on the items we plan to write to our DynamoDbTable,
49-
// we must explicitly configure how they should be treated during item encryption:
50-
// - ENCRYPT_AND_SIGN: The attribute is encrypted and included in the signature
51-
// - SIGN_ONLY: The attribute not encrypted, but is still included in the signature
52-
// - DO_NOTHING: The attribute is not encrypted and not included in the signature
53-
var attributeActionsOnEncrypt = new Dictionary<string, CryptoAction>
54-
{
55-
["partition_key"] = CryptoAction.SIGN_ONLY, // Our partition attribute must be SIGN_ONLY
56-
["sort_key"] = CryptoAction.SIGN_ONLY, // Our sort attribute must be SIGN_ONLY
57-
["attribute1"] = CryptoAction.ENCRYPT_AND_SIGN,
58-
["attribute2"] = CryptoAction.SIGN_ONLY,
59-
["attribute3"] = CryptoAction.DO_NOTHING
60-
};
61-
62-
// 3. Configure which attributes we expect to be excluded in the signature
63-
// when reading items.
64-
// For this example, we will explicitly list the attributes that are not signed.
65-
var unsignedAttributes = new List<string> { "attribute3" };
66-
67-
// 4. Create the DynamoDb Encryption configuration for the table we will be writing to.
68-
// This configuration uses PlaintextOverride.FORBID_PLAINTEXT_WRITE_FORBID_PLAINTEXT_READ
69-
// which means:
70-
// - Write: Items are forbidden to be written as plaintext.
39+
// 1. Create table configurations
40+
// In this of migration we will use PlaintextOverride.FORBID_PLAINTEXT_WRITE_FORBID_PLAINTEXT_READ
41+
// which means:
42+
// - Write: Items are forbidden to be written as plaintext.
7143
// Items will be written as encrypted items.
72-
// - Read: Items are forbidden to be read as plaintext.
73-
// Items will be read as encrypted items.
74-
// Note: If you do not specify a PlaintextOverride, it defaults to
75-
// FORBID_PLAINTEXT_WRITE_FORBID_PLAINTEXT_READ, which is the desired
76-
// behavior for a client interacting with a fully encrypted database.
77-
var tableConfig = new DynamoDbTableEncryptionConfig
78-
{
79-
LogicalTableName = ddbTableName,
80-
PartitionKeyName = "partition_key",
81-
SortKeyName = "sort_key",
82-
AttributeActionsOnEncrypt = attributeActionsOnEncrypt,
83-
Keyring = kmsKeyring,
84-
AllowedUnsignedAttributes = unsignedAttributes,
85-
PlaintextOverride = PlaintextOverride.FORBID_PLAINTEXT_WRITE_FORBID_PLAINTEXT_READ
86-
};
87-
88-
var tableConfigs = new Dictionary<string, DynamoDbTableEncryptionConfig>
89-
{
90-
[ddbTableName] = tableConfig
91-
};
44+
// - Read: Items are forbidden to be read as plaintext.
45+
// Items will be read as encrypted items.
46+
// Note: If you do not specify a PlaintextOverride, it defaults to
47+
// FORBID_PLAINTEXT_WRITE_FORBID_PLAINTEXT_READ, which is the desired
48+
// behavior for a client interacting with a fully encrypted database.
49+
var tableConfigs = Common.CreateTableConfigs(kmsKeyId, ddbTableName, PlaintextOverride.FORBID_PLAINTEXT_WRITE_FORBID_PLAINTEXT_READ);
9250

93-
// 5. Create a new AWS SDK DynamoDb client using the TableEncryptionConfigs
51+
// 2. Create a new AWS SDK DynamoDb client using the TableEncryptionConfigs
9452
var ddb = new Client.DynamoDbClient(
9553
new DynamoDbTablesEncryptionConfig { TableEncryptionConfigs = tableConfigs });
9654

97-
// 6. Put an item into our table using the above client.
55+
// 3. Put an item into our table using the above client.
9856
// This item will be encrypted due to our PlaintextOverride configuration.
9957
string encryptedAndSignedValue = MigrationUtils.ENCRYPTED_AND_SIGNED_VALUE;
10058
string signOnlyValue = MigrationUtils.SIGN_ONLY_VALUE;
@@ -117,7 +75,7 @@ public static async Task<bool> MigrationStep3Example(string kmsKeyId, string ddb
11775
var putResponse = await ddb.PutItemAsync(putRequest);
11876
Debug.Assert(putResponse.HttpStatusCode == HttpStatusCode.OK);
11977

120-
// 7. Get an item back from the table using the same client.
78+
// 4. Get an item back from the table using the same client.
12179
// If this is an item written in plaintext (i.e. any item written
12280
// during Step 0 or 1), then the read will fail, as we have
12381
// configured our client to forbid reading plaintext items.
@@ -143,7 +101,7 @@ public static async Task<bool> MigrationStep3Example(string kmsKeyId, string ddb
143101
var getResponse = await ddb.GetItemAsync(getRequest);
144102
Debug.Assert(getResponse.HttpStatusCode == HttpStatusCode.OK);
145103

146-
// 8. Verify we get the expected item back
104+
// Verify we get the expected item back
147105
if (getResponse.Item == null)
148106
{
149107
throw new Exception("No item found");

0 commit comments

Comments
 (0)