Update attrs minimum version to 19.1.0 and migrate all validator use to new validators in that version

Amazon DynamoDB Encryption Client for Python

The Amazon DynamoDB Encryption Client for Python provides client-side encryption of Amazon DynamoDB items to help you to protect your table data before you send it to DynamoDB. It provides an implementation of the Amazon DynamoDB Encryption Client that is fully compatible with the Amazon DynamoDB Encryption Client for Java.

You can find the latest Python documentation at Read the Docs and you can find the latest full documents in our primary documents.

You can find our source on GitHub.

Security issue notifications

See Support Policy for details on the current support status of all major versions of this library.

Getting Started

Required Prerequisites

Python 3.8+

Installation

Note

If you have not already installed cryptography, you might need to install additional prerequisites as detailed in the cryptography installation guide for your operating system.

$ pip install dynamodb-encryption-sdk

Concepts

For a detailed description of the concepts that are important to understand when using this client, please review our Concepts Guide.

Usage

Helper Clients

We provide helper clients that look and feel like the low level client (EncryptedClient), service resource (EncryptedResource), and table resource (EncryptedTable) available from the boto3 library. For most uses, once configured, these clients can be used exactly as you would a standard client from boto3, and your items will be transparently encrypted on write and decrypted on read.

What can't I do with the helper clients?

For most uses, the helper clients (once configured) can be used as drop-in replacements for the boto3 clients. However, there are a couple cases where this is not the case.

Update Item

Because we can't know that a partial update you might be making to an item covers all of the signed attributes in your item, we do not allow update_item on the helper clients.

This is because if you update only some of the signed attributes, then next time you try to read that item the signature validation will fail.

Attribute Filtering

Because we can't know what attributes in an item are signed, the helper clients do not allow any attribute filtering.

For get_item, batch_get_item, and scan, this includes the use of AttributesToGet and ProjectionExpression.

For scan, this also includes the use of Select values SPECIFIC_ATTRIBUTES and ALL_PROJECTED_ATTRIBUTES.

This is because if you do not retrieve all signed attributes, the signature validation will fail.

Item Encryptor

The helper clients provide a familiar interface but the actual item encryption and decryption is handled by a low-level item encryptor. You usually will not need to interact with these low-level functions, but for certain advanced use cases it can be useful.

If you do choose to use the item encryptor functions directly, you will need to provide a CryptoConfig for each call.

>>> from dynamodb_encryption_sdk.encrypted.item import decrypt_python_item, encrypt_python_item
>>> plaintext_item = {
...     'some': 'data',
...     'more': 5
... }
>>> encrypted_item = encrypt_python_item(
...     item=plaintext_item,
...     crypto_config=my_crypto_config
... )
>>> decrypted_item = decrypt_python_item(
...     item=encrypted_item,
...     crypto_config=my_crypto_config
... )

When should I use the item encryptor?

One example of a use case where you might want to use the item encryptor directly is when processing items in a DynamoDB Stream. Since you receive the items data directly, and in DynamoDB JSON format, you can use the decrypt_dynamodb_item function to decrypt the item in the stream. We also provide helper transformation functions

Advanced Use

By default, the helper clients use your attribute actions and cryptographic materials provider to build the CryptoConfig that is provided to the item encryptor. For some advanced use cases, you might want to provide a custom CryptoConfig for specific operations.

All data plane operations (get item, put item, etc) on helper clients accept a crypto_config parameter in addition to all of the parameters that the underlying boto3 client accepts.

If this parameter is supplied, that CryptoConfig will be used for that operation instead of the one that the client would normally construct for you.

>>> from dynamodb_encryption_sdk.encrypted.table import EncryptedTable
>>> encrypted_table = EncryptedTable(
...     table=table,
...     materials_provider=my_crypto_materials_provider
... )
>>> encrypted_table.put_item(
...     Item=my_standard_item
... )  # this uses the crypto config built by the helper
>>> encrypted_table.put_item(
...     Item=my_special_item,
...     crypto_config=my_special_crypto_config
... )  # this uses my_special_crypto_config

category	percent	downloads
2.7	90.10%	137,955
3.6	8.47%	12,966
3.7	0.85%	1,304
null	0.57%	866
3.5	0.01%	14
3.4	0.01%	9
3.8	0.00%	1
Total		153,115

category	percent	downloads
2.7	86.56%	22,766
3.6	11.22%	2,951
3.7	1.86%	489
null	0.35%	93
3.5	0.00%	1
Total		26,300

	try: # Python 3.5.0 and 3.5.1 have incompatible typing modules
	from typing import Dict, Iterable, List, Optional, Set, Text # noqa pylint: disable=unused-import
	except ImportError: # pragma: no cover
	# We only actually need these imports when running the mypy checks
	pass

	def __attrs_post_init__(self):
	# () -> None
	"""Determine if any actions should ever be taken with this configuration and record that for reference."""
	for attribute in ReservedAttributes:
	if attribute.value in self.attribute_actions:
	raise ValueError('No override behavior can be set for reserved attribute "{}"'.format(attribute.value))

	# Enums are not hashable, but their names are unique
	_unique_actions = {self.default_action.name}
	_unique_actions.update({action.name for action in self.attribute_actions.values()})
	no_actions = _unique_actions == {CryptoAction.DO_NOTHING.name}
	self.take_no_actions = no_actions # attrs confuses pylint: disable=attribute-defined-outside-init

	if crypto_config.attribute_actions.take_no_actions:
	# If we explicitly have been told not to do anything to this item, just copy it.
	return item.copy()

aws / aws-dynamodb-encryption-python Goto Github PK

aws-dynamodb-encryption-python's Introduction

Amazon DynamoDB Encryption Client for Python

Getting Started

Required Prerequisites

Installation

Concepts

Usage

Helper Clients

What can't I do with the helper clients?

Update Item

Attribute Filtering

Item Encryptor

When should I use the item encryptor?

Advanced Use

aws-dynamodb-encryption-python's People

Contributors

Stargazers

Watchers

Forkers

aws-dynamodb-encryption-python's Issues

Security issue notifications

Problem:

Solution:

Out of scope:

Date range: 2019-01-01 - 2019-12-31

Date range: 2019-11-01 - 2019-11-30

Problem:

Solution:

Out of scope:

Workaround

Problem

Problem:

Solution:

Problem:

Solution:

Recommend Projects

Recommend Topics

Recommend Org