software.amazon.jdbc.plugin.encryption.key

Class KeyManager

java.lang.Object

software.amazon.jdbc.plugin.encryption.key.KeyManager

public class KeyManager
extends java.lang.Object

Manages KMS operations and data key lifecycle for the encryption plugin. Handles key creation, data key generation/decryption, and database storage of key metadata.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	KeyManager.DataKeyResult Result class for data key generation operations.

Constructor Summary

Constructors

Constructor and Description
KeyManager(software.amazon.awssdk.services.kms.KmsClient kmsClient, java.sql.Connection connection, boolean isPostgreSQL, EncryptionConfig config)
KeyManager(software.amazon.awssdk.services.kms.KmsClient kmsClient, PluginService pluginService, EncryptionConfig config)

Method Summary

Modifier and Type	Method and Description
void	clearCache() Clears the data key cache.
java.lang.String	createMasterKey(java.lang.String description) Creates a new KMS master key with the specified description.
byte[]	decryptDataKey(java.lang.String encryptedDataKey, java.lang.String masterKeyArn) Decrypts an encrypted data key using KMS with caching support.
KeyManager.DataKeyResult	generateDataKey(java.lang.String masterKeyArn) Generates a new data key using the specified master key.
java.lang.String	generateKeyId() Generates a unique key ID for new keys to store in the database.
DataKeyCache	getDataKeyCache() Returns the data key cache for metrics and management.
java.util.Optional<KeyMetadata>	getKeyMetadata(java.lang.String keyId) Retrieves key metadata from the database for the specified key ID.
boolean	isPostgreSQL()
void	shutdown() Shuts down the key manager and cleans up resources.
int	storeKeyMetadata(java.lang.String tableName, java.lang.String columnName, KeyMetadata keyMetadata) Stores key metadata in the database for the specified table and column.
void	updateLastUsed(java.lang.String keyId) Updates the last used timestamp for the specified key.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

KeyManager

public KeyManager(software.amazon.awssdk.services.kms.KmsClient kmsClient,
                  PluginService pluginService,
                  EncryptionConfig config)

KeyManager

public KeyManager(software.amazon.awssdk.services.kms.KmsClient kmsClient,
                  java.sql.Connection connection,
                  boolean isPostgreSQL,
                  EncryptionConfig config)

Method Detail

isPostgreSQL

public boolean isPostgreSQL()

createMasterKey

public java.lang.String createMasterKey(java.lang.String description)
                                 throws KeyManagementException

Creates a new KMS master key with the specified description.

Parameters:

description - Description for the master key

Returns:

The ARN of the created master key

Throws:

KeyManagementException - if key creation fails

generateDataKey

public KeyManager.DataKeyResult generateDataKey(java.lang.String masterKeyArn)
                                         throws KeyManagementException

Generates a new data key using the specified master key.

Parameters:

masterKeyArn - ARN of the master key to use for data key generation

Returns:

DataKeyResult containing both plaintext and encrypted data keys

Throws:

KeyManagementException - if data key generation fails

decryptDataKey

public byte[] decryptDataKey(java.lang.String encryptedDataKey,
                             java.lang.String masterKeyArn)
                      throws KeyManagementException

Decrypts an encrypted data key using KMS with caching support.

Parameters:

encryptedDataKey - Base64-encoded encrypted data key

masterKeyArn - ARN of the master key used for encryption

Returns:

Decrypted data key as byte array

Throws:

KeyManagementException - if decryption fails

storeKeyMetadata

public int storeKeyMetadata(java.lang.String tableName,
                            java.lang.String columnName,
                            KeyMetadata keyMetadata)
                     throws KeyManagementException

Stores key metadata in the database for the specified table and column.

Parameters:

tableName - Name of the table

columnName - Name of the column

keyMetadata - Key metadata to store

Returns:

the generated integer ID

Throws:

KeyManagementException - if storage fails

getKeyMetadata

public java.util.Optional<KeyMetadata> getKeyMetadata(java.lang.String keyId)
                                               throws KeyManagementException

Retrieves key metadata from the database for the specified key ID.

Parameters:

keyId - Key ID to retrieve metadata for

Returns:

Optional containing key metadata if found

Throws:

KeyManagementException - if retrieval fails

updateLastUsed

public void updateLastUsed(java.lang.String keyId)
                    throws KeyManagementException

Updates the last used timestamp for the specified key.

Parameters:

keyId - Key ID to update

Throws:

KeyManagementException - if update fails

generateKeyId

public java.lang.String generateKeyId()

Generates a unique key ID for new keys to store in the database.

Returns:

Unique key ID

getDataKeyCache

public DataKeyCache getDataKeyCache()

Returns the data key cache for metrics and management.

Returns:

Data key cache instance

clearCache

public void clearCache()

Clears the data key cache.

shutdown

public void shutdown()

Shuts down the key manager and cleans up resources.