11package connection
22
33import (
4+ "context"
5+ "errors"
46 "fmt"
57
6- "github.com/flanksource/commons-db/context"
8+ "github.com/aws/aws-sdk-go-v2/aws"
9+ "github.com/aws/aws-sdk-go-v2/service/kms"
10+ "github.com/aws/aws-sdk-go-v2/service/kms/types"
11+ "github.com/aws/smithy-go"
12+ commonsContext "github.com/flanksource/commons-db/context"
713 "github.com/flanksource/commons-db/models"
14+ "gocloud.dev/gcerrors"
815 "gocloud.dev/secrets"
9- "gocloud.dev/secrets/awskms "
16+ "gocloud.dev/secrets/driver "
1017)
1118
1219type AWSKMS struct {
@@ -25,17 +32,75 @@ func (t *AWSKMS) FromModel(conn models.Connection) {
2532 t .KeyID = conn .Properties ["keyID" ]
2633}
2734
28- func (t * AWSKMS ) SecretKeeper (ctx context .Context ) (* secrets.Keeper , error ) {
35+ func (t * AWSKMS ) SecretKeeper (ctx commonsContext .Context ) (* secrets.Keeper , error ) {
2936 awsConfig , err := t .AWSConnection .Client (ctx )
3037 if err != nil {
3138 return nil , fmt .Errorf ("failed to create AWS client: %w" , err )
3239 }
3340
34- kmsClient , err := awskms .DialV2 (awsConfig )
41+ keeper := secrets .NewKeeper (& awsKMSKeeper {
42+ keyID : t .KeyID ,
43+ client : kms .NewFromConfig (awsConfig ),
44+ })
45+ return keeper , nil
46+ }
47+
48+ type awsKMSKeeper struct {
49+ keyID string
50+ client * kms.Client
51+ }
52+
53+ var _ driver.Keeper = (* awsKMSKeeper )(nil )
54+
55+ func (k * awsKMSKeeper ) Decrypt (ctx context.Context , ciphertext []byte ) ([]byte , error ) {
56+ result , err := k .client .Decrypt (ctx , & kms.DecryptInput {
57+ CiphertextBlob : ciphertext ,
58+ })
3559 if err != nil {
36- return nil , fmt . Errorf ( "failed to create AWS KMS client: %w" , err )
60+ return nil , err
3761 }
62+ return result .Plaintext , nil
63+ }
3864
39- keeper := awskms .OpenKeeperV2 (kmsClient , t .KeyID , nil )
40- return keeper , nil
65+ func (k * awsKMSKeeper ) Encrypt (ctx context.Context , plaintext []byte ) ([]byte , error ) {
66+ result , err := k .client .Encrypt (ctx , & kms.EncryptInput {
67+ KeyId : aws .String (k .keyID ),
68+ Plaintext : plaintext ,
69+ })
70+ if err != nil {
71+ return nil , err
72+ }
73+ return result .CiphertextBlob , nil
74+ }
75+
76+ func (k * awsKMSKeeper ) Close () error { return nil }
77+
78+ func (k * awsKMSKeeper ) ErrorAs (err error , i any ) bool {
79+ return errors .As (err , i )
80+ }
81+
82+ func (k * awsKMSKeeper ) ErrorCode (err error ) gcerrors.ErrorCode {
83+ var apiErr smithy.APIError
84+ if ! errors .As (err , & apiErr ) {
85+ return gcerrors .Unknown
86+ }
87+
88+ switch apiErr .ErrorCode () {
89+ case (& types.NotFoundException {}).ErrorCode ():
90+ return gcerrors .NotFound
91+ case (& types.InvalidCiphertextException {}).ErrorCode (), (& types.InvalidKeyUsageException {}).ErrorCode ():
92+ return gcerrors .InvalidArgument
93+ case (& types.KMSInternalException {}).ErrorCode ():
94+ return gcerrors .Internal
95+ case (& types.KMSInvalidStateException {}).ErrorCode ():
96+ return gcerrors .FailedPrecondition
97+ case (& types.DisabledException {}).ErrorCode (), (& types.InvalidGrantTokenException {}).ErrorCode ():
98+ return gcerrors .PermissionDenied
99+ case (& types.KeyUnavailableException {}).ErrorCode ():
100+ return gcerrors .ResourceExhausted
101+ case (& types.DependencyTimeoutException {}).ErrorCode ():
102+ return gcerrors .DeadlineExceeded
103+ default :
104+ return gcerrors .Unknown
105+ }
41106}
0 commit comments