iceberg::InMemoryKms Class Reference

KMS client with in-memory master keys. Not for production use. More...

#include <in_memory_kms.h>

Inheritance diagram for iceberg::InMemoryKms:

Public Member Functions
	InMemoryKms (std::unordered_map< std::string, std::vector< uint8_t > > master_keys)
Status	Initialize (const std::unordered_map< std::string, std::string > &properties) override
	Add master keys from encryption.in-memory-kms.key.<id> properties.
Result< std::vector< uint8_t > >	WrapKey (std::span< const uint8_t > key, std::string_view wrapping_key_id) override
	Wrap (encrypt) a secret key with the master key wrapping_key_id.
Result< std::vector< uint8_t > >	UnwrapKey (std::span< const uint8_t > wrapped_key, std::string_view wrapping_key_id) override
	Unwrap a key returned by WrapKey.
Public Member Functions inherited from iceberg::KeyManagementClient
virtual bool	SupportsKeyGeneration () const
	Whether the KMS can generate keys (GenerateKey).
virtual Result< GeneratedKey >	GenerateKey (std::string_view)
	Generate a new key in the KMS, returned in plain and wrapped form.

Static Public Member Functions
static void	Register ()
	Register this client in KmsRegistry under kName.

Static Public Attributes
static constexpr std::string_view	kName = "in-memory"
	The name used with encryption.kms-impl after RegisterInMemoryKms().
static constexpr std::string_view	kKeyPropertyPrefix = "encryption.in-memory-kms.key."
	Catalog property prefix for master keys: encryption.in-memory-kms.key.<id> = Base64 of the key bytes.

Detailed Description

KMS client with in-memory master keys. Not for production use.

Wire compatible with Java's MemoryMockKMS (used by Java tests through UnitestKMS): keys are wrapped with AES-GCM under the master key, as nonce | ciphertext | tag, without AAD.

Member Function Documentation

Initialize()

Status iceberg::InMemoryKms::Initialize ( const std::unordered_map< std::string, std::string > &  properties )

overridevirtual

Add master keys from encryption.in-memory-kms.key.<id> properties.

Reimplemented from iceberg::KeyManagementClient.

UnwrapKey()

Result< std::vector< uint8_t > > iceberg::InMemoryKms::UnwrapKey ( std::span< const uint8_t >  wrapped_key, std::string_view  wrapping_key_id  )

overridevirtual

Unwrap a key returned by WrapKey.

Implements iceberg::KeyManagementClient.

WrapKey()

Result< std::vector< uint8_t > > iceberg::InMemoryKms::WrapKey ( std::span< const uint8_t >  key, std::string_view  wrapping_key_id  )

overridevirtual

Wrap (encrypt) a secret key with the master key wrapping_key_id.

The result may include KMS-specific metadata needed to unwrap it.

Implements iceberg::KeyManagementClient.

---

The documentation for this class was generated from the following file:

• iceberg/encryption/in_memory_kms.h