data AWS::KMS::Envelope(kms: AWS::KMS, key_id: String, encryption_context: Hash[String, String], allowed_keys: Array[String], resolved: Atom[AWS::KMS::Envelope::Resolution?])
Envelope encryption: each secret encrypted locally with AES-256-GCM
under a fresh data key from KMS (generate_data_key), the data key
kept, encrypted under the KMS key, with the ciphertext. For secrets
over KMS's 4 KB, and for many secrets without a KMS call each to
encrypt (opening one decrypts its data key through KMS). Nothing is
cached but the key an alias or a bare key id names (RESOLVED_FOR).
A sealed value is one Bytes: a version byte (1); the length of the
KMS key's ARN (one byte) and the ARN, as generate_data_key gave it
(open decrypts under that key, when it accepts it: the key key_id
names, or one of allowed_keys); the encrypted data key's length
(two bytes, big-endian) and the key; the 12-byte nonce; then the
ciphertext and its 16-byte tag. The bytes before the ciphertext are
its additional authenticated data, so that none of them can be
changed either.
creds = AWS::Credentials.static(access_key_id: "AKIDEXAMPLE", secret_access_key: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY")
kms = AWS::KMS.new(AWS::Config.new(region: "ap-northeast-1", credentials: creds))
box = AWS::KMS::Envelope.new(kms, "alias/app", {"tenant" => "t1"})
box.inspect # => "#<AWS::KMS::Envelope alias/app>"
/home/runner/work/aws/aws/src/kms.qz:390
Constants
RESOLVED_FOR: Duration
How long the key an alias or a bare key id resolved to is kept before it is asked again (a moved alias is also followed at the first value it refuses).
VERSION: Int
The format's version byte.
NONCE_SIZE: Int
The nonce's size.
KEY_ARN: Regexp
A KMS key's ARN (not an alias's).
Methods
def kms -> AWS::KMS
The client.
def key_id -> String
The KMS key data keys are made under: an id, an ARN or
alias/name.
def encryption_context -> Hash[String, String]
The encryption context each data key is bound to (and must be given again to open).
def allowed_keys -> Array[String]
The key ARNs open accepts besides the one key_id names (that of
an alias's previous key, once it was moved).
def to_h -> Hash[Symbol, Object]
The fields as a Hash, by name.
def with(*, kms: AWS::KMS = …, key_id: String = …, encryption_context: Hash[String, String] = …, allowed_keys: Array[String] = …, resolved: Atom[AWS::KMS::Envelope::Resolution?] = …) -> AWS::KMS::Envelope
A copy with the fields given replaced.
def seal(plaintext: Bytes | String) -> Bytes
plaintext sealed under a new data key.
def open(sealed: Bytes) -> Bytes
The plaintext of sealed, its data key decrypted through KMS
under the key the header names, when that is the key key_id names
(an alias followed if it moved) or one of allowed_keys.
Raises
ArgumentError when allowed_keys holds what is not a key ARN.
AWS::Error for bytes that are not a sealed value of this format,
were altered, or name a key not accepted: AWS::ServiceError, a
subclass, when KMS will not
decrypt the data key (another encryption context, an altered key
or ARN).
def inspect -> String
#<AWS::KMS::Envelope alias/app>.
def to_s -> String
As inspect.