Package io.confluent.kafka.schemaregistry.encryption.azure

Class AzureKmsDriver

java.lang.Object

io.confluent.kafka.schemaregistry.encryption.azure.AzureKmsDriver

All Implemented Interfaces:

KmsDriver

public class AzureKmsDriver
extends Object
implements KmsDriver

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CLIENT_ID
static final String	CLIENT_SECRET
static final String	ENCRYPT_AZURE_KEY_VERSION_SAVE	Enables making a DEK's encryptedKeyMaterial self-describing with respect to which exact Azure Key Vault key version wrapped it (see AzureKmsAead), matching the same self-description property AWS KMS and GCP KMS ciphertext already provide natively.
static final String	TENANT_ID
static final String	TEST_KEY_CLIENT

Fields inherited from interface io.confluent.kafka.schemaregistry.encryption.tink.KmsDriver

KMS_TYPE_SUFFIX, TEST_CLIENT

Constructor Summary

Constructors

Constructor	Description
AzureKmsDriver()

Method Summary

Modifier and Type	Method	Description
String	getKeyUrlPrefix()
static String	getVersionedKeyId(Map<String,?> configs, String kmsKeyId)	Resolves a possibly-versionless Azure Key Vault key identifier (e.g.
boolean	isAccessDeniedException(Throwable t)
static boolean	isVersionless(String kmsKeyId)	Returns true if kmsKeyId has no explicit version segment.
com.google.crypto.tink.KmsClient	newKmsClient(Map<String,?> configs, Optional<String> kekUrl)
protected static com.google.crypto.tink.KmsClient	newKmsClientWithAzureKms(Map<String,?> configs, Optional<String> keyUri, Optional<com.azure.core.credential.TokenCredential> credentials, com.azure.security.keyvault.keys.cryptography.CryptographyClient cryptographyClient)
static String	withVersion(String kmsKeyId, String version)	Combines kmsKeyId (versionless or versioned; only the vault and key name are used) with an explicit version, returning the full versioned key identifier.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.confluent.kafka.schemaregistry.encryption.tink.KmsDriver

doesSupport, getKmsClient, getTestClient, isAccessDenied, isAccessDeniedStatus, registerKmsClient

Field Details

TENANT_ID

public static final String TENANT_ID

See Also:

• Constant Field Values

CLIENT_ID

public static final String CLIENT_ID

See Also:

• Constant Field Values

CLIENT_SECRET

public static final String CLIENT_SECRET

See Also:

• Constant Field Values

ENCRYPT_AZURE_KEY_VERSION_SAVE

public static final String ENCRYPT_AZURE_KEY_VERSION_SAVE

Enables making a DEK's encryptedKeyMaterial self-describing with respect to which exact Azure Key Vault key version wrapped it (see AzureKmsAead), matching the same self-description property AWS KMS and GCP KMS ciphertext already provide natively. Set as a kek kmsProps entry.

See Also:

• Constant Field Values

TEST_KEY_CLIENT

public static final String TEST_KEY_CLIENT

See Also:

• Constant Field Values

Constructor Details

AzureKmsDriver

public AzureKmsDriver()

Method Details

getKeyUrlPrefix

public String getKeyUrlPrefix()

Specified by:

getKeyUrlPrefix in interface KmsDriver

isAccessDeniedException

public boolean isAccessDeniedException(Throwable t)

Specified by:

isAccessDeniedException in interface KmsDriver

getVersionedKeyId

public static String getVersionedKeyId(Map<String,?> configs,
 String kmsKeyId)
                                throws GeneralSecurityException

Resolves a possibly-versionless Azure Key Vault key identifier (e.g. https://vault.vault.azure.net/keys/name) into the concrete, currently-enabled version (e.g. https://vault.vault.azure.net/keys/name/<version>). If kmsKeyId already includes a version segment, it is returned unchanged and no call is made. This exists because, unlike AWS KMS and GCP KMS, Azure Key Vault's wrap/unwrap operations address an explicit key version and do not embed that version in the returned ciphertext, so a caller that only ever uses a versionless reference has no way to know which version encrypted a given DEK once the key has been rotated.

Throws:

GeneralSecurityException

withVersion

public static String withVersion(String kmsKeyId,
 String version)
                          throws GeneralSecurityException

Combines kmsKeyId (versionless or versioned; only the vault and key name are used) with an explicit version, returning the full versioned key identifier. Used to reconstruct a target for a version extracted from an already-wrapped DEK, which may differ from whatever getVersionedKeyId(java.util.Map<java.lang.String, ?>, java.lang.String) currently resolves to (e.g. after a rotation).

Throws:

GeneralSecurityException

isVersionless

public static boolean isVersionless(String kmsKeyId)
                             throws GeneralSecurityException

Returns true if kmsKeyId has no explicit version segment. Used to warn when ENCRYPT_AZURE_KEY_VERSION_SAVE is not enabled for a versionless key, without performing any actual resolution (no KeyClient call).

Throws:

GeneralSecurityException

newKmsClient

public com.google.crypto.tink.KmsClient newKmsClient(Map<String,?> configs,
 Optional<String> kekUrl)
                                              throws GeneralSecurityException

Specified by:

newKmsClient in interface KmsDriver

Throws:

GeneralSecurityException

newKmsClientWithAzureKms

protected static com.google.crypto.tink.KmsClient newKmsClientWithAzureKms(Map<String,?> configs,
 Optional<String> keyUri,
 Optional<com.azure.core.credential.TokenCredential> credentials,
 com.azure.security.keyvault.keys.cryptography.CryptographyClient cryptographyClient)
                                                                    throws GeneralSecurityException

Throws:

GeneralSecurityException