Package com.salesforce.multicloudj.kms.client

Class KmsClient

java.lang.Object
com.salesforce.multicloudj.kms.client.KmsClient
All Implemented Interfaces:
AutoCloseable
public class KmsClient extends Object implements AutoCloseable
Entry point for client code to manage keys in a cloud key management service in a substrate-agnostic way.

Usage example: 

 KmsClient client = KmsClient.builder(providerId)
     .withRegion(region)
     .withKeyContainer(keyContainer)
     .build();

 CreateKeyResponse created = client.createKey(CreateKeyRequest.builder()
     .keyName("orders-root-key")
     .description("Root key for order data")
     .build());
 client.tagKey(created.getKeyRef(), Map.of("team", "orders"));

  • Field Details

  • Constructor Details

  • Method Details

    • builder

      public static KmsClient.KmsClientBuilder builder(String providerId)
      Creates a new KmsClientBuilder for the specified provider.
      Parameters:
      providerId - the ID of the provider such as "aws", "gcp", or "ali"
      Returns:
      a new KmsClientBuilder instance

    • createKey

      public CreateKeyResponse createKey(CreateKeyRequest request)
      Creates a symmetric key.
      Parameters:
      request - the key's configuration
      Returns:
      a reference to the new key and its initial state
      Throws:
      SubstrateSdkException - if the operation fails

    • enableKey

      public void enableKey(KeyRef keyRef)
      Enables a key. When KeyRef.getVersionId() is set, providers that keep state per version enable only that version; the others enable the whole key.
      Parameters:
      keyRef - the key to enable
      Throws:
      SubstrateSdkException - if the operation fails

    • disableKey

      public void disableKey(KeyRef keyRef)
      Disables a key. When KeyRef.getVersionId() is set, providers that keep state per version disable only that version; the others disable the whole key.
      Parameters:
      keyRef - the key to disable
      Throws:
      SubstrateSdkException - if the operation fails

    • getImportParameters

      public ImportParameters getImportParameters(GetImportParametersRequest request)
      Starts an import session for a key created with external origin.
      Parameters:
      request - the key and the wrapping configuration
      Returns:
      the public key and token to use with importKeyMaterial(com.salesforce.multicloudj.kms.model.ImportKeyMaterialRequest)
      Throws:
      SubstrateSdkException - if the operation fails

    • importKeyMaterial

      public KeyRef importKeyMaterial(ImportKeyMaterialRequest request)
      Imports wrapped key material into a key created with external origin.
      Parameters:
      request - the key, import token and wrapped material
      Returns:
      a reference to the key, including the version created for the material where the provider versions keys
      Throws:
      SubstrateSdkException - if the operation fails

    • setKeyPolicy

      public void setKeyPolicy(KeyRef keyRef, KeyPolicy policy)
      Replaces the access policy attached to a key.
      Parameters:
      keyRef - the key whose policy is replaced
      policy - the new policy
      Throws:
      SubstrateSdkException - if the operation fails, including UnSupportedOperationException when the policy uses anything outside getPolicyCapabilities()

    • getKeyPolicy

      public KeyPolicy getKeyPolicy(KeyRef keyRef)
      Reads the access policy attached to a key. Native policy entries that the KeyPolicy model cannot express are omitted.
      Parameters:
      keyRef - the key whose policy is read
      Returns:
      the key's policy
      Throws:
      SubstrateSdkException - if the operation fails

    • tagKey

      public void tagKey(KeyRef keyRef, Map<String,String> tags)
      Adds or overwrites tags on a key. Existing tags with other names are kept.
      Parameters:
      keyRef - the key to tag
      tags - tag names and values
      Throws:
      SubstrateSdkException - if the operation fails

    • encrypt

      public EncryptResponse encrypt(EncryptRequest request)
      Encrypts a small payload directly with a key.
      Parameters:
      request - the key, plaintext and encryption context
      Returns:
      the ciphertext
      Throws:
      SubstrateSdkException - if the operation fails

    • decrypt

      public DecryptResponse decrypt(DecryptRequest request)
      Decrypts a ciphertext produced by encrypt(com.salesforce.multicloudj.kms.model.EncryptRequest).
      Parameters:
      request - the ciphertext and encryption context
      Returns:
      the plaintext
      Throws:
      SubstrateSdkException - if the operation fails

    • getPolicyCapabilities

      public PolicyCapabilities getPolicyCapabilities()
      Describes the subset of the KeyPolicy model the provider enforces.
      Returns:
      the provider's policy capabilities

    • supportsMultiRegionKeys

      public boolean supportsMultiRegionKeys()
      Whether this client can create keys with CreateKeyRequest.multiRegion set.
      Returns:
      true if multi-region keys can be created

    • close

      public void close() throws Exception
      Specified by:
      close in interface AutoCloseable
      Throws:
      Exception