Merge branch 'main' into benchmark

Author: josecorella

DynamoDbEncryption/runtimes/java/src/main/sdkv1/com/amazonaws/services/dynamodbv2/datamodeling/internal/Hkdf.java

@@ -207,42 +207,7 @@ public byte[] deriveKey(final String info, final int length)
   public byte[] deriveKey(final byte[] info, final int length)
     throws IllegalStateException {
     byte[] result = new byte[length];
-    try {
-      deriveKey(info, length, result, 0);
-    } catch (ShortBufferException ex) {
-      // This exception is impossible as we ensure the buffer is long
-      // enough
-      throw new RuntimeException(ex);
-    }
-    return result;
-  }
-
-  /**
-   * Derives a pseudorandom key of <code>length</code> bytes and stores the result in <code>output
-   * </code>.
-   *
-   * @param info optional context and application specific information (can be a zero-length array).
-   * @param length the length of the output key in bytes
-   * @param output the buffer where the pseudorandom key will be stored
-   * @param offset the offset in <code>output</code> where the key will be stored
-   * @throws ShortBufferException if the given output buffer is too small to hold the result
-   * @throws IllegalStateException if this object has not been initialized
-   */
-  public void deriveKey(
-    final byte[] info,
-    final int length,
-    final byte[] output,
-    final int offset
-  ) throws ShortBufferException, IllegalStateException {
     assertInitialized();
-    if (length < 0) {
-      throw new IllegalArgumentException(
-        "Length must be a non-negative value."
-      );
-    }
-    if (output.length < offset + length) {
-      throw new ShortBufferException();
-    }
     Mac mac = createMac();
 
     if (length > 255 * mac.getMacLength()) {
@@ -262,14 +227,15 @@ public void deriveKey(
         t = mac.doFinal();
 
         for (int x = 0; x < t.length && loc < length; x++, loc++) {
-          output[loc] = t[x];
+          result[loc] = t[x];
         }
 
         i++;
       }
     } finally {
       Arrays.fill(t, (byte) 0); // Zeroize temporary array
     }
+    return result;
   }
 
   private Mac createMac() {

DynamoDbEncryption/runtimes/rust/Cargo.toml

@@ -18,7 +18,7 @@ readme = "README.md"
 [dependencies]
 aws-config = "1.8.10"
 aws-lc-rs = {version = "1.15.0"}
-aws-lc-sys = { version = "0.33", optional = true }
+aws-lc-sys = { version = "0.36", optional = true }
 aws-lc-fips-sys = { version = "0.13", optional = true }
 aws-sdk-dynamodb = "1.99.0"
 aws-sdk-kms = "1.94.0"

cfn/CI.yaml

@@ -59,9 +59,6 @@ Resources:
           KeyType: "HASH"
         - AttributeName: "sort_key"
           KeyType: "RANGE"
-      ProvisionedThroughput:
-        ReadCapacityUnits: "5"
-        WriteCapacityUnits: "5"
       TableName: !Ref TableName
 
   # These tables were manually created but not used in CI
@@ -88,7 +85,26 @@ Resources:
           AttributeType: "S"
         - AttributeName: "aws_dbe_b_stateAndHasSensitiveData"
           AttributeType: "S"
+        - AttributeName: "aws_dbe_b_address"
+          AttributeType: "S"
+        - AttributeName: "aws_dbe_b_birthday"
+          AttributeType: "S"
+        - AttributeName: "aws_dbe_b_buildingAndFloor"
+          AttributeType: "S"
+        - AttributeName: "aws_dbe_b_email"
+          AttributeType: "S"
+        - AttributeName: "aws_dbe_b_stateAndHasTestResult"
+          AttributeType: "S"
       GlobalSecondaryIndexes:
+        - IndexName: "stateAndHasTestResult-index"
+          KeySchema:
+            - AttributeName: "aws_dbe_b_stateAndHasTestResult"
+              KeyType: "HASH"
+          Projection:
+            ProjectionType: ALL
+          ProvisionedThroughput:
+            ReadCapacityUnits: "5"
+            WriteCapacityUnits: "5"
         - IndexName: "state-zip-index"
           KeySchema:
             - AttributeName: "aws_dbe_b_state"
@@ -118,6 +134,37 @@ Resources:
           ProvisionedThroughput:
             ReadCapacityUnits: "5"
             WriteCapacityUnits: "5"
+        - IndexName: "buildingAndFloor-index"
+          KeySchema:
+            - AttributeName: "aws_dbe_b_buildingAndFloor"
+              KeyType: "HASH"
+          Projection:
+            ProjectionType: ALL
+          ProvisionedThroughput:
+            ReadCapacityUnits: "5"
+            WriteCapacityUnits: "5"
+        - IndexName: "email-birthday-index"
+          KeySchema:
+            - AttributeName: "aws_dbe_b_email"
+              KeyType: "HASH"
+            - AttributeName: "aws_dbe_b_birthday"
+              KeyType: "RANGE"
+          Projection:
+            ProjectionType: ALL
+          ProvisionedThroughput:
+            ReadCapacityUnits: "5"
+            WriteCapacityUnits: "5"
+        - IndexName: "address-birthday-index"
+          KeySchema:
+            - AttributeName: "aws_dbe_b_address"
+              KeyType: "HASH"
+            - AttributeName: "aws_dbe_b_birthday"
+              KeyType: "RANGE"
+          Projection:
+            ProjectionType: ALL
+          ProvisionedThroughput:
+            ReadCapacityUnits: "5"
+            WriteCapacityUnits: "5"
       KeySchema:
         - AttributeName: "customer_id"
           KeyType: "HASH"
@@ -272,6 +319,8 @@ Resources:
               - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${SearchTestJavaTableName}/index/*"
               - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${SearchTestDotnetTableName}"
               - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${SearchTestDotnetTableName}/index/*"
+              - "arn:aws:dynamodb:us-west-2:370957321024:table/v2MostRecentKeyProviderPerfTestKeys"
+              - "arn:aws:dynamodb:us-west-2:370957321024:table/v2MostRecentKeyProviderPerfTestKeys/index/*"
 
   KMSUsage:
     Type: "AWS::IAM::ManagedPolicy"
@@ -324,18 +373,35 @@ Resources:
               - !Sub "arn:aws:kms:eu-west-1:658956600833:key/*"
               - !Sub "arn:aws:kms:eu-west-1:658956600833:alias/*"
 
+  PerformanceBenchmarksCloudWatchUsage:
+    Type: "AWS::IAM::ManagedPolicy"
+    Properties:
+      Description: "Allow CloudWatch Logs operations for performance benchmarks"
+      ManagedPolicyName: !Sub "DBESDK-Performance-Benchmarks-CloudWatch-${AWS::Region}"
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Action:
+              - logs:CreateLogGroup
+              - logs:CreateLogStream
+              - logs:PutLogEvents
+              - logs:DescribeLogStreams
+            Resource: !Sub "arn:aws:logs:*:*:log-group:aws-dbesdk-performance-benchmarks:*"
+
   GitHubCIRole:
     Type: "AWS::IAM::Role"
     Properties:
       RoleName: !Sub "GitHub-CI-${ProjectName}-Role-${AWS::Region}"
-      Description: "Access DDB, KMS, & CA Resources for CI from GitHub"
+      Description: "Access DDB, KMS, and CA Resources for CI from GitHub"
       ManagedPolicyArns:
         - Fn::ImportValue: "Polymorph-CA-GitHubCAReadPolicyArn"
         - "arn:aws:iam::370957321024:policy/ESDK-Dafny-DDB-ReadWriteDelete-us-west-2"
         - "arn:aws:iam::370957321024:policy/Hierarchical-GitHub-KMS-Key-Policy"
         - "arn:aws:iam::370957321024:policy/Github-ECDH-KMS"
         - !Ref KMSUsage
         - !Ref DDBUsage
+        - !Ref PerformanceBenchmarksCloudWatchUsage
       AssumeRolePolicyDocument: !Sub |
         {
           "Version": "2012-10-17",   
@@ -351,7 +417,8 @@ Resources:
                 "StringLike": {
                   "token.actions.githubusercontent.com:sub": [
                     "repo:aws/aws-database-encryption-sdk-dynamodb:*",
-                    "repo:aws/private-aws-database-encryption-sdk-dynamodb-java-staging:*"
+                    "repo:aws/private-aws-database-encryption-sdk-dynamodb-java-staging:*",
+                    "repo:aws/aws-cryptographic-material-providers-library:*"
                   ]
                 }
               }