chore: update internal legacy override with adapter pattern by rishav-karanjit · Pull Request #2054 · aws/aws-database-encryption-sdk-dynamodb

rishav-karanjit · 2026-02-03T21:33:23Z

Issue #, if available:

Description of changes:
Ignore the formatting. I will do it later as this PR is not just getting staged in a feature branch. I have many feature branches which I am working in parallel and the cost of rebasing is a lot if I do it now as there will be a lot of common files being touched.

Things done in this PR:

applied adapter pattern in internal legacy override so that it will work for both DDBEC with SDK v1 and DDBEC with SDK v2.
Renamed DynamoDbEncryptor -> DynamoDBEncryptor to align with what is there in DDBEC with SDK v1.
Made DynamoDBEncryptor in SDK v2 implement ILegacyDynamoDbEncryptor
Made getSignatureFieldName and getMaterialDescriptionFieldName public as it was needed in internal legacy override of DB-ESDK.

Things not done:

testing. Thought to do it later as a integration test while auditing test.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

This reverts commit ec8077c.

…encryption-sdk-dynamodb into ddbec/sdkv2/ci

This reverts commit ec8077c.

…database-encryption-sdk-dynamodb into rishav/ddbec-v2/adapter

Added permissions for contents and id-token in PR CI workflow.

rishav-karanjit · 2026-02-05T00:41:20Z

      String,
      software.amazon.awssdk.services.dynamodb.model.AttributeValue
    > input
  ) {


Suggested change

) {

if (input == null) {

return null;

}

V2MapToV1Map exists in main too but in main there is no code path that can send null. V2MapToV1Map in main is used only after encryptRecord/decryptRecord which by design does not return null. However, in this PR V2MapToV1Map function can get null as input as this function is used by convertEncryptionContextV1ToV2 for which a possible output of v1Context.getAttributeValues() is null as AttributeValues is optional in EC

texastony

In general, looks good. I need to pull this down locally to see what is going on with the trickier things.

texastony · 2026-02-09T19:55:21Z

+  private final DafnySequence<Character> materialDescriptionFieldNameDafnyType;
+  private final DafnySequence<Character> signatureFieldNameDafnyType;


Nit: I thought these were holding types, but they just the Java-Dafny types.
You could just have the suffix be Dafny.

Suggested change

private final DafnySequence<Character> materialDescriptionFieldNameDafnyType;

private final DafnySequence<Character> signatureFieldNameDafnyType;

private final DafnySequence<Character> materialDescriptionFieldNameDafny;

private final DafnySequence<Character> signatureFieldNameDafny;

Done here: b2d2414

texastony · 2026-02-09T20:03:22Z

    }

+    final LegacyEncryptorAdapter encryptorAdapter;
+    if (maybeEncryptor instanceof DynamoDBEncryptor) {


Help a reader out?
Go ahead and give us the full namespace for DynamoDBEncryptor,
like you do for the SDKV2 one.

Done for this code and other similar places: b2d2414

texastony · 2026-02-09T20:09:18Z

    final software.amazon.cryptography.dbencryptionsdk.dynamodb.internaldafny.types.LegacyOverride legacyOverride =
      encryptorConfig.dtor_legacyOverride().dtor_value();

    final ILegacyDynamoDbEncryptor maybeEncryptor =


Question: If this is a native value, which is what ..ToNative. returns, then why is it a Maybe?
It is an encryptor.
If legacyOverride.dtor_encryptor is not set, I am failrly certain a weird error will be thrown...

Until now, we know its a ILegacyDynamoDbEncryptor which is a interface but we don't know the actual object type (i.e Encryptor from v1 or v2 SDK).

Would renaming maybeEncryptor to maybeIEncryptor make it more clearer?

From Slack:

Maybe is a convention we use when it is an optional or possibly going to be an error.
Here, the think it is not optional nor is cannot it be an error...

Sure. What do you think of the variable name iEncryptor?

👍

texastony · 2026-02-09T20:20:15Z

+  @Override
+  public Map<
+    String,
+    software.amazon.awssdk.services.dynamodb.model.AttributeValue


This V1 class always returns in V2 terms; this means a customers MUST have both SDK v1 and SDK v2 loaded to use this V1 class.
Which is OK... It is some artifact bloat, but that is a common part of the Dafny experience.

Yes. If using DB-ESDK, SDK V2 must be in included in the artifact.

Is it SDK v1 & SDK v2, or only SDK v2?

texastony · 2026-02-09T20:23:12Z

I need to review this file locally.
There is a lot going on here.

## [4.0.0](v3.9.1...v4.0.0) (2026-04-16) ### ⚠ BREAKING CHANGES * **.net:** Bump MPL V2 (#2145) ### feat * **.net:** Bump MPL V2 ([#2145](#2145)) ([87c534b](87c534b)) ### Fixes -- Java * **java:** drop hkdf offset method ([#2222](#2222)) ([7aad5fb](7aad5fb)) ### Maintenance -- Java * **java:** Attempt to reduce flaky CI ([#2220](#2220)) ([987aec6](987aec6)) * **java:** attempt to reduce flaky CI failures ([#2203](#2203)) ([b4d88f1](b4d88f1)) * **java:** merge from main ([53d6ba3](53d6ba3)) * **java:** shut down local DDB in test ([#2176](#2176)) ([fa1e151](fa1e151)) ### Maintenance -- Rust * **rust:** release v1.2.4 ([#2184](#2184)) ([6823d31](6823d31)) ### Miscellaneous * **.net:** add ddb local to .net release ([#2075](#2075)) ([db55bdf](db55bdf)) * **.net:** comment out testvectors from release ([#2076](#2076)) ([fdaa9e3](fdaa9e3)) * **.net:** fix release commands to include all json tv files ([#2072](#2072)) ([10f809d](10f809d)) * **.net:** pin mpl to latest ([#2065](#2065)) ([f6b64a6](f6b64a6)) * **.net:** reference submoduled mpl ([#2080](#2080)) ([be3f58f](be3f58f)) * add code coverage check ([#2171](#2171)) ([c2ae8e7](c2ae8e7)) * add DDBEC examples ([#2064](#2064)) ([9b7c284](9b7c284)) * add integration test and unit test ([#2139](#2139)) ([3cb8a96](3cb8a96)) * add migration examples ([#2057](#2057)) ([18dbc50](18dbc50)) * add more interop tests ([#2131](#2131)) ([c06bc3a](c06bc3a)) * add multi order test ([#2170](#2170)) ([d09cd16](d09cd16)) * add test for DDBEC with sdk v2 ([#2126](#2126)) ([e3ac7cd](e3ac7cd)) * add user agent string ([#2172](#2172)) ([88c597c](88c597c)) * bump GitHub Actions to latest versions ([#2144](#2144)) ([92615d4](92615d4)) * **ci:** add workflow_dispatch and remove run on PR for daily CI ([#2218](#2218)) ([d6fd0fb](d6fd0fb)) * **ci:** daily ci for branches ([#2208](#2208)) ([fcc4b97](fcc4b97)) * **ci:** remove branch default to main ([#2219](#2219)) ([1a3d1f0](1a3d1f0)) * **CI:** run clippy ([#2181](#2181)) ([6b54985](6b54985)) * **ci:** run test on Java 21 and windows OS ([#2159](#2159)) ([6e702d8](6e702d8)) * **ci:** use snapshot builds ([#2083](#2083)) ([0124ca6](0124ca6)) * copy DDBEC with SDK v2 code as-is from internal ([#2047](#2047)) ([dc439b4](dc439b4)) * delete ddbec which uses AWS SDK Java v1 ([#2193](#2193)) ([bb74687](bb74687)) * **deps:** bump actions/checkout v5->v6 and setup-docker-macos-action v1.0.2->v1.1.0 ([#2130](#2130)) ([337c776](337c776)) * **deps:** update aws-lc-sys requirement from 0.38 to 0.39 in /DynamoDbEncryption/runtimes/rust ([#2149](#2149)) ([b76bcb7](b76bcb7)) * fix CI (almost) and make AWS SDK v1 compileOnly ([#2049](#2049)) ([e509a56](e509a56)) * merge from main ([e9f8259](e9f8259)) * merge from main 2nd try ([eb17468](eb17468)) * merge from main and fix ubuntu failing ([#2192](#2192)) ([3317b4d](3317b4d)) * move put cache after signature verification ([#2223](#2223)) ([49b8b67](49b8b67)) * refactor non-prod CI to only run Go targets ([#2134](#2134)) ([0d2622c](0d2622c)) * release aws-db-esdk v1.2.3 ([#2122](#2122)) ([888aaba](888aaba)) * Rename `Directkmsmaterialsprovider` to `Directkmsmaterialprovider` ([#2150](#2150)) ([4126efa](4126efa)) * rename and format ([#2118](#2118)) ([091b7b4](091b7b4)) * run java test on ubuntu ([#2167](#2167)) ([cffa72c](cffa72c)) * update internal legacy override with adapter pattern ([#2054](#2054)) ([abbac83](abbac83)) * update readme and remove comments in CI ([#2158](#2158)) ([7e1c863](7e1c863))

rishav-karanjit added 19 commits January 30, 2026 11:10

copy code from internal

ec8077c

m

e89541c

m

f6f27e4

Revert "copy code from internal"

e5ea095

This reverts commit ec8077c.

Merge branch 'ddbec/sdkv2/ci' of https://github.com/aws/aws-database-…

03d25db

…encryption-sdk-dynamodb into ddbec/sdkv2/ci

m

ea7b465

m

0290cff

m

c3d2567

adapter

53297ce

m

817d8fa

Revert "copy code from internal"

f520e9d

This reverts commit ec8077c.

copy code from internal

7ebefe7

m

75255c0

m

294abef

adapter

5a57429

Merge branch 'rishav/ddbec-v2/adapter' of https://github.com/aws/aws-…

cab0510

…database-encryption-sdk-dynamodb into rishav/ddbec-v2/adapter

m

018c92b

formatting

eef8a56

m

ce47673

rishav-karanjit marked this pull request as ready for review February 3, 2026 23:37

rishav-karanjit requested a review from a team as a code owner February 3, 2026 23:37

rishav-karanjit added 3 commits February 3, 2026 16:52

m

befb6bd

m

651d343

m

4b157e2

rishav-karanjit changed the title ~~chore: use adapter pattern in internal legacy override~~ chore: update internal legacy override with adapter pattern Feb 4, 2026

rishav-karanjit and others added 2 commits February 4, 2026 10:09

m

07d9e4d

Update permissions in pull request workflow

3298a2d

Added permissions for contents and id-token in PR CI workflow.

rishav-karanjit commented Feb 5, 2026

View reviewed changes

m

e319647

texastony reviewed Feb 9, 2026

View reviewed changes

Tony's comment

b2d2414

texastony approved these changes Feb 10, 2026

View reviewed changes

rishav-karanjit merged commit abbac83 into ddbec-with-sdk-v2 Feb 24, 2026
41 of 48 checks passed

rishav-karanjit deleted the rishav/ddbec-v2/adapter branch February 24, 2026 19:39

+  ) {
+	  if (input == null) {
+	    return null;
+	  }

		private final DafnySequence<Character> materialDescriptionFieldNameDafnyType;
		private final DafnySequence<Character> signatureFieldNameDafnyType;

Uh oh!

Conversation

rishav-karanjit commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

texastony left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rishav-karanjit commented Feb 3, 2026 •

edited

Loading