Class AwsKmsMasterKey

Namespace

Nops.Core.Keys

Assembly

Nops.Core.AwsKms.dll

Master key provider for AWS KMS keys used by SOPS. Wraps AWSSDK.KMS Decrypt to unwrap the encrypted data key share.

public class AwsKmsMasterKey : IMasterKeyProvider

Inheritance

object

AwsKmsMasterKey

Implements

IMasterKeyProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

AwsKmsMasterKey(string, string, IReadOnlyList<KeyValuePair<string, string>>?, IAmazonKeyManagementService?)

Creates a new AWS KMS master key provider.

public AwsKmsMasterKey(string arn, string encryptedShare = "", IReadOnlyList<KeyValuePair<string, string>>? context = null, IAmazonKeyManagementService? client = null)

Parameters

arn string

encryptedShare string

context IReadOnlyList<KeyValuePair<string, string>>

client IAmazonKeyManagementService

Properties

Arn

The ARN of the KMS key (e.g., arn:aws:kms:us-east-1:123456789012:key/abcd-1234-5678-efgh)

public string Arn { get; }

Property Value

string

Client

The KMS client used for decryption. If null, uses the default credential chain.

public IAmazonKeyManagementService? Client { get; }

Property Value

IAmazonKeyManagementService

Context

Optional encryption context key-value pairs. Must match what was used during encryption.

public IReadOnlyList<KeyValuePair<string, string>> Context { get; }

Property Value

IReadOnlyList<KeyValuePair<string, string>>

EncryptedShare

Informational only: decryption uses the encrypted share read from the SOPS file metadata, so this can be left empty.

public string EncryptedShare { get; }

Property Value

string

KeyType

The key type identifier ("aws_kms").

public string KeyType { get; }

Property Value

string

Methods

DecryptShareAsync(string, CancellationToken)

Decrypt the encrypted data key share using AWS KMS. Returns null if this key cannot decrypt (ARN/context mismatch handled by caller).

public Task<byte[]?> DecryptShareAsync(string enc, CancellationToken ct = default)

Parameters

enc string

ct CancellationToken

Returns

Task<byte[]>