key_management_client.h

Go to the documentation of this file.

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
 
#pragma once
 
 
#include <cstdint>
#include <functional>
#include <memory>
#include <span>
#include <string>
#include <string_view>
#include <unordered_map>
#include <vector>
 
#include "iceberg/iceberg_export.h"
#include "iceberg/result.h"
 
namespace iceberg {
 
class ICEBERG_EXPORT KeyManagementClient {
 public:
  struct GeneratedKey {
    std::vector<uint8_t> key;
    std::vector<uint8_t> wrapped_key;
  };
 
  virtual ~KeyManagementClient() = default;
 
  virtual Status Initialize(
      const std::unordered_map<std::string, std::string>& /*properties*/) {
    return {};
  }
 
  virtual Result<std::vector<uint8_t>> WrapKey(std::span<const uint8_t> key,
                                               std::string_view wrapping_key_id) = 0;
 
  virtual Result<std::vector<uint8_t>> UnwrapKey(std::span<const uint8_t> wrapped_key,
                                                 std::string_view wrapping_key_id) = 0;
 
  virtual bool SupportsKeyGeneration() const { return false; }
 
  virtual Result<GeneratedKey> GenerateKey(std::string_view /*wrapping_key_id*/) {
    return NotSupported("Key generation is not supported by this KMS client");
  }
};
 
class ICEBERG_EXPORT KmsRegistry {
 public:
  static constexpr std::string_view kKmsType = "encryption.kms-type";
  static constexpr std::string_view kKmsImpl = "encryption.kms-impl";
  static constexpr std::string_view kKmsTypeAws = "aws";
  static constexpr std::string_view kKmsTypeGcp = "gcp";
  static constexpr std::string_view kKmsTypeAzure = "azure";
 
  using Properties = std::unordered_map<std::string, std::string>;
  using Factory = std::function<Result<std::unique_ptr<KeyManagementClient>>()>;
 
  static void Register(std::string name, Factory factory);
 
  static Result<std::shared_ptr<KeyManagementClient>> Load(std::string_view name,
                                                           const Properties& properties);
 
  static Result<std::shared_ptr<KeyManagementClient>> FromCatalogProperties(
      const Properties& properties);
};
 
}  // namespace iceberg