iceberg::KeyManagementClient Class Reference

Wraps and unwraps secret keys with master keys kept in a KMS. More...

#include <key_management_client.h>

Inheritance diagram for iceberg::KeyManagementClient:

Classes
struct	GeneratedKey
	A generated key and its wrapped form. More...

Public Member Functions
virtual Status	Initialize (const std::unordered_map< std::string, std::string > &)
	Initialize the client with the catalog properties.
virtual Result< std::vector< uint8_t > >	WrapKey (std::span< const uint8_t > key, std::string_view wrapping_key_id)=0
	Wrap (encrypt) a secret key with the master key wrapping_key_id.
virtual Result< std::vector< uint8_t > >	UnwrapKey (std::span< const uint8_t > wrapped_key, std::string_view wrapping_key_id)=0
	Unwrap a key returned by WrapKey.
virtual bool	SupportsKeyGeneration () const
	Whether the KMS can generate keys (GenerateKey).
virtual Result< GeneratedKey >	GenerateKey (std::string_view)
	Generate a new key in the KMS, returned in plain and wrapped form.

Detailed Description

Wraps and unwraps secret keys with master keys kept in a KMS.

Mirrors Java's org.apache.iceberg.encryption.KeyManagementClient. The table master key (table property encryption.key-id) never leaves the KMS; it only wraps and unwraps the table's key encryption keys.

Member Function Documentation

Initialize()

virtual Status iceberg::KeyManagementClient::Initialize ( const std::unordered_map< std::string, std::string > &  )

inlinevirtual

Initialize the client with the catalog properties.

Reimplemented in iceberg::InMemoryKms.

UnwrapKey()

virtual Result< std::vector< uint8_t > > iceberg::KeyManagementClient::UnwrapKey ( std::span< const uint8_t >  wrapped_key, std::string_view  wrapping_key_id  )

pure virtual

Unwrap a key returned by WrapKey.

Implemented in iceberg::InMemoryKms.

WrapKey()

virtual Result< std::vector< uint8_t > > iceberg::KeyManagementClient::WrapKey ( std::span< const uint8_t >  key, std::string_view  wrapping_key_id  )

pure virtual

Wrap (encrypt) a secret key with the master key wrapping_key_id.

The result may include KMS-specific metadata needed to unwrap it.

Implemented in iceberg::InMemoryKms.

---

The documentation for this class was generated from the following file:

• iceberg/encryption/key_management_client.h