kms_keyring.h

Go to the documentation of this file.

/*
 * Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License"). You may not use
 * this file except in compliance with the License. A copy of the License is
 * located at
 *
 *     http://aws.amazon.com/apache2.0/
 *
 * or in the "license" file accompanying this file. This file is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
 * implied. See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifndef AWS_ENCRYPTION_SDK_KMS_KEYRING_H
#define AWS_ENCRYPTION_SDK_KMS_KEYRING_H
 
#include <aws/cryptosdk/cpp/exports.h>
 
#include <aws/core/Aws.h>
#include <aws/core/utils/Outcome.h>
#include <aws/core/utils/memory/stl/AWSMap.h>
#include <aws/core/utils/memory/stl/AWSSet.h>
#include <aws/core/utils/memory/stl/AWSString.h>
#include <aws/core/utils/memory/stl/AWSVector.h>
#include <aws/cryptosdk/materials.h>
#include <aws/kms/KMSClient.h>
#include <functional>
#include <mutex>
 
namespace Aws {
namespace Cryptosdk {
namespace KmsKeyring {
class ClientSupplier;
class DiscoveryFilter;


class AWS_CRYPTOSDK_CPP_API Builder {
   public:
    Builder &WithGrantToken(const Aws::String &grant_token);

    Builder &WithGrantTokens(const Aws::Vector<Aws::String> &grant_tokens);

    Builder &WithClientSupplier(const std::shared_ptr<ClientSupplier> &client_supplier);

    Builder &WithKmsClient(const std::shared_ptr<KMS::KMSClient> &kms_client);

    aws_cryptosdk_keyring *Build(
        const Aws::String &generator_key_id, const Aws::Vector<Aws::String> &additional_key_ids = {}) const;

    aws_cryptosdk_keyring *BuildDiscovery() const;

    aws_cryptosdk_keyring *BuildDiscovery(std::shared_ptr<KmsKeyring::DiscoveryFilter> discovery_filter) const;
 
   private:
    std::shared_ptr<KMS::KMSClient> kms_client;
    Aws::Vector<Aws::String> grant_tokens;
    std::shared_ptr<ClientSupplier> client_supplier;
};

class AWS_CRYPTOSDK_CPP_API ClientSupplier {
   public:
    virtual ~ClientSupplier(){};
    virtual std::shared_ptr<KMS::KMSClient> GetClient(
        const Aws::String &region, std::function<void()> &report_success) = 0;
};
 
class AWS_CRYPTOSDK_CPP_API CachingClientSupplier : public ClientSupplier {
   public:
    static std::shared_ptr<CachingClientSupplier> Create();

    std::shared_ptr<KMS::KMSClient> GetClient(const Aws::String &region, std::function<void()> &report_success);
 
   protected:
    mutable std::mutex cache_mutex;
    Aws::Map<Aws::String, std::shared_ptr<Aws::KMS::KMSClient>> cache;
};

class AWS_CRYPTOSDK_CPP_API SingleClientSupplier : public ClientSupplier {
   public:
    static std::shared_ptr<SingleClientSupplier> Create(const std::shared_ptr<KMS::KMSClient> &kms_client);

    std::shared_ptr<KMS::KMSClient> GetClient(const Aws::String &, std::function<void()> &report_success);
 
    SingleClientSupplier(const std::shared_ptr<KMS::KMSClient> &kms_client) : kms_client(kms_client) {}
 
   private:
    std::shared_ptr<KMS::KMSClient> kms_client;
};

class AWS_CRYPTOSDK_CPP_API DiscoveryFilterBuilder {
   public:
    DiscoveryFilterBuilder(Aws::String partition) : partition(partition) {}

    DiscoveryFilterBuilder &AddAccount(const Aws::String &account_id);

    DiscoveryFilterBuilder &AddAccounts(const Aws::Vector<Aws::String> &account_ids);

    DiscoveryFilterBuilder &WithAccounts(const Aws::Vector<Aws::String> &account_ids);

    std::shared_ptr<DiscoveryFilter> Build() const;
 
   private:
    Aws::String partition;
    Aws::Set<Aws::String> account_ids;
};

class AWS_CRYPTOSDK_CPP_API DiscoveryFilter {
   public:
    bool IsAuthorized(const Aws::String &key_arn) const;
 
    DiscoveryFilter() = delete;

    static DiscoveryFilterBuilder Builder(Aws::String partition);
 
   protected:
    DiscoveryFilter(Aws::String partition, Aws::Set<Aws::String> account_ids)
        : partition(partition), account_ids(account_ids) {}
 
   private:
    Aws::String partition;
    Aws::Set<Aws::String> account_ids;
};
  // doxygen group kms_keyring
 
}  // namespace KmsKeyring
 
}  // namespace Cryptosdk
}  // namespace Aws
 
#endif  // AWS_ENCRYPTION_SDK_KMS_KEYRING_H