Package com.salesforce.multicloudj.kms.driver

Interface KeyManagement

All Superinterfaces:
Provider, SdkService
All Known Implementing Classes:
AbstractKms, AliKms, AwsKms, GcpKms
public interface KeyManagement extends Provider
Portable control-plane operations on keys held by a cloud key management service.

  • Method Details

    • createKey

      CreateKeyResponse createKey(CreateKeyRequest request)
      Creates a symmetric key.
      Parameters:
      request - the key's configuration
      Returns:
      a reference to the new key and its initial state

    • enableKey

      void enableKey(KeyRef keyRef)
      Enables a key so it can be used for cryptographic operations. When KeyRef.getVersionId() is set, providers that keep state per version enable only that version; the others enable the whole key.
      Parameters:
      keyRef - the key to enable

    • disableKey

      void disableKey(KeyRef keyRef)
      Disables a key so it can no longer be used for cryptographic operations. When KeyRef.getVersionId() is set, providers that keep state per version disable only that version; the others disable the whole key.
      Parameters:
      keyRef - the key to disable

    • getImportParameters

      ImportParameters getImportParameters(GetImportParametersRequest request)
      Starts an import session for a key created with external origin.
      Parameters:
      request - the key and the wrapping configuration
      Returns:
      the public key and token to use with importKeyMaterial(com.salesforce.multicloudj.kms.model.ImportKeyMaterialRequest)

    • importKeyMaterial

      KeyRef importKeyMaterial(ImportKeyMaterialRequest request)
      Imports wrapped key material into a key created with external origin.
      Parameters:
      request - the key, import token and wrapped material
      Returns:
      a reference to the key, including the version created for the material where the provider versions keys

    • setKeyPolicy

      void setKeyPolicy(KeyRef keyRef, KeyPolicy policy)
      Replaces the access policy attached to a key.
      Parameters:
      keyRef - the key whose policy is replaced
      policy - the new policy
      Throws:
      UnSupportedOperationException - if the policy uses anything outside getPolicyCapabilities()

    • getKeyPolicy

      KeyPolicy getKeyPolicy(KeyRef keyRef)
      Reads the access policy attached to a key. Native policy entries that the KeyPolicy model cannot express are omitted.
      Parameters:
      keyRef - the key whose policy is read
      Returns:
      the key's policy

    • tagKey

      void tagKey(KeyRef keyRef, Map<String,String> tags)
      Adds or overwrites tags on a key. Existing tags with other names are kept.
      Parameters:
      keyRef - the key to tag
      tags - tag names and values

    • getPolicyCapabilities

      PolicyCapabilities getPolicyCapabilities()
      Describes the subset of the KeyPolicy model this provider enforces.
      Returns:
      the provider's policy capabilities

    • supportsMultiRegionKeys

      boolean supportsMultiRegionKeys()
      Whether keys created by this client can be made available across regions with CreateKeyRequest.multiRegion. May depend on configuration such as the key container.
      Returns:
      true if multi-region keys can be created

    • encrypt

      default EncryptResponse encrypt(EncryptRequest request)
      Encrypts a small payload directly with a key.
      Parameters:
      request - the key, plaintext and encryption context
      Returns:
      the ciphertext
      Throws:
      UnSupportedOperationException - if the provider does not offer direct encryption

    • decrypt

      default DecryptResponse decrypt(DecryptRequest request)
      Decrypts a ciphertext produced by encrypt(com.salesforce.multicloudj.kms.model.EncryptRequest).
      Parameters:
      request - the ciphertext and encryption context
      Returns:
      the plaintext
      Throws:
      UnSupportedOperationException - if the provider does not offer direct decryption