aws-cryptography-internal-dynamodb

import os import boto3 from aws_dynamodb_encryption_sdk.encrypted.table import EncryptedTable from aws_encryption_sdk.key_providers.kms import KMSKeyring # NOTE: This quickstart demonstrates usage of the PARENT library: `aws-sdk-dynamodb-encryption`. # This internal package (`aws-cryptography-internal-dynamodb`) is NOT for direct use. # Ensure you have installed the public-facing SDK: `pip install aws-sdk-dynamodb-encryption` # Configuration TABLE_NAME = os.environ.get('DYNAMODB_TABLE_NAME', 'my-encrypted-table') KMS_KEY_ARN = os.environ.get('KMS_KEY_ARN', 'arn:aws:kms:us-west-2:123456789012:key/your-kms-key-id') REGION = os.environ.get('AWS_REGION', 'us-west-2') # Initialize boto3 DynamoDB client dynamodb_client = boto3.client('dynamodb', region_name=REGION) # Create a KMS Keyring keyring = KMSKeyring(key_ids=[KMS_KEY_ARN]) # Create an EncryptedTable instance for your DynamoDB table # The master key provider is used to encrypt/decrypt data on the client side encrypted_table = EncryptedTable( table=boto3.resource('dynamodb', region_name=REGION).Table(TABLE_NAME), keyring=keyring ) # Example: Put an item into the encrypted table item_id = 'item123' item_data = {'id': item_id, 'data': 'sensitive_info', 'cleartext_attribute': 'visible_data'} print(f"Putting item: {item_data}") encrypted_table.put_item(Item=item_data) # Example: Get an item from the encrypted table retrieved_item = encrypted_table.get_item(Key={'id': item_id})['Item'] print(f"Retrieved item: {retrieved_item}") # Verify decryption (sensitive_info should be visible) assert retrieved_item['data'] == 'sensitive_info' print("Item successfully encrypted and decrypted.")