software.amazon.jdbc.plugin.encryption.key

Class KeyManagementUtility

java.lang.Object

software.amazon.jdbc.plugin.encryption.key.KeyManagementUtility

public class KeyManagementUtility
extends java.lang.Object

Utility class providing administrative functions for key management operations. This class offers high-level methods for creating master keys, setting up encryption for tables/columns, rotating keys, and managing the encryption lifecycle.

Constructor Summary

Constructors

Constructor and Description
KeyManagementUtility(KeyManager keyManager, MetadataManager metadataManager, java.sql.Connection connection, software.amazon.awssdk.services.kms.KmsClient kmsClient, EncryptionConfig config)
KeyManagementUtility(KeyManager keyManager, MetadataManager metadataManager, javax.sql.DataSource dataSource, software.amazon.awssdk.services.kms.KmsClient kmsClient, EncryptionConfig config)

Method Summary

Modifier and Type	Method and Description
java.lang.String	createMasterKeyWithPermissions(java.lang.String description) Creates a master key with default permissions suitable for JDBC encryption.
java.lang.String	createMasterKeyWithPermissions(java.lang.String description, @Nullable java.lang.String keyPolicy) Creates a new KMS master key with proper permissions for encryption operations.
void	generateAndStoreDataKey(java.lang.String tableName, java.lang.String columnName, java.lang.String masterKeyArn, java.lang.String algorithm) Generates and stores a data key for the specified table and column.
java.util.List<java.lang.String>	getColumnsUsingKey(java.lang.String keyId) Lists all columns that use a specific key ID.
void	initializeEncryptionForColumn(java.lang.String tableName, java.lang.String columnName, java.lang.String masterKeyArn) Initializes encryption for a new table and column combination.
void	initializeEncryptionForColumn(java.lang.String tableName, java.lang.String columnName, java.lang.String masterKeyArn, java.lang.String algorithm) Initializes encryption for a new table and column combination with specified algorithm.
void	removeEncryptionForColumn(java.lang.String tableName, java.lang.String columnName) Removes encryption configuration for a table and column.
void	rotateDataKey(java.lang.String tableName, java.lang.String columnName, @Nullable java.lang.String newMasterKeyArn) Rotates the data key for an existing encrypted column.
boolean	validateMasterKey(java.lang.String masterKeyArn) Validates that a master key exists and is accessible.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

KeyManagementUtility

public KeyManagementUtility(KeyManager keyManager,
                            MetadataManager metadataManager,
                            javax.sql.DataSource dataSource,
                            software.amazon.awssdk.services.kms.KmsClient kmsClient,
                            EncryptionConfig config)

KeyManagementUtility

public KeyManagementUtility(KeyManager keyManager,
                            MetadataManager metadataManager,
                            java.sql.Connection connection,
                            software.amazon.awssdk.services.kms.KmsClient kmsClient,
                            EncryptionConfig config)

Method Detail

createMasterKeyWithPermissions

public java.lang.String createMasterKeyWithPermissions(java.lang.String description,
                                                       @Nullable java.lang.String keyPolicy)
                                                throws KeyManagementException

Creates a new KMS master key with proper permissions for encryption operations.

Parameters:

description - Description for the master key

keyPolicy - Optional key policy JSON string. If null, uses default policy

Returns:

The ARN of the created master key

Throws:

KeyManagementException - if key creation fails

createMasterKeyWithPermissions

public java.lang.String createMasterKeyWithPermissions(java.lang.String description)
                                                throws KeyManagementException

Creates a master key with default permissions suitable for JDBC encryption.

Parameters:

description - Description for the master key

Returns:

The ARN of the created master key

Throws:

KeyManagementException - if key creation fails

generateAndStoreDataKey

public void generateAndStoreDataKey(java.lang.String tableName,
                                    java.lang.String columnName,
                                    java.lang.String masterKeyArn,
                                    java.lang.String algorithm)
                             throws KeyManagementException

Generates and stores a data key for the specified table and column. This method creates the complete encryption setup for a column.

Parameters:

tableName - Name of the table

columnName - Name of the column

masterKeyArn - ARN of the master key to use

algorithm - Encryption algorithm (defaults to AES-256-GCM if null)

Throws:

KeyManagementException - if key generation or storage fails

rotateDataKey

public void rotateDataKey(java.lang.String tableName,
                          java.lang.String columnName,
                          @Nullable java.lang.String newMasterKeyArn)
                   throws KeyManagementException

Rotates the data key for an existing encrypted column. This creates a new data key while preserving the existing encryption metadata.

Parameters:

tableName - Name of the table

columnName - Name of the column

newMasterKeyArn - Optional new master key ARN. If null, uses existing master key

Throws:

KeyManagementException - if key rotation fails

initializeEncryptionForColumn

public void initializeEncryptionForColumn(java.lang.String tableName,
                                          java.lang.String columnName,
                                          java.lang.String masterKeyArn)
                                   throws KeyManagementException

Initializes encryption for a new table and column combination. This is a convenience method that creates everything needed for encryption.

Parameters:

tableName - Name of the table

columnName - Name of the column

masterKeyArn - ARN of the master key to use

Throws:

KeyManagementException - if initialization fails

initializeEncryptionForColumn

public void initializeEncryptionForColumn(java.lang.String tableName,
                                          java.lang.String columnName,
                                          java.lang.String masterKeyArn,
                                          java.lang.String algorithm)
                                   throws KeyManagementException

Initializes encryption for a new table and column combination with specified algorithm.

Parameters:

tableName - Name of the table

columnName - Name of the column

masterKeyArn - ARN of the master key to use

algorithm - Encryption algorithm to use

Throws:

KeyManagementException - if initialization fails

removeEncryptionForColumn

public void removeEncryptionForColumn(java.lang.String tableName,
                                      java.lang.String columnName)
                               throws KeyManagementException

Removes encryption configuration for a table and column. This does not delete the actual key data for security reasons.

Parameters:

tableName - Name of the table

columnName - Name of the column

Throws:

KeyManagementException - if removal fails

getColumnsUsingKey

public java.util.List<java.lang.String> getColumnsUsingKey(java.lang.String keyId)
                                                    throws KeyManagementException

Lists all columns that use a specific key ID. Useful for understanding the impact of key operations.

Parameters:

keyId - The key ID to search for

Returns:

List of table.column identifiers using the key

Throws:

KeyManagementException - if query fails

validateMasterKey

public boolean validateMasterKey(java.lang.String masterKeyArn)
                          throws KeyManagementException

Validates that a master key exists and is accessible.

Parameters:

masterKeyArn - ARN of the master key to validate

Returns:

true if key is valid and accessible

Throws:

KeyManagementException - if validation fails