How aws/aws-database-encryption-sdk-dynamodb works
The product is a client-side DynamoDB encryption SDK: applications encrypt selected item attributes before storage and decrypt them within the application. The tree shows Java integration points for DynamoDB clients, enhanced-client configuration, legacy encryption, transforms, and generated Dafny interfaces, plus Java materials providers. The sampled code directly confirms query input/output transform behavior in the test server and Rust materials-manager adaptation; most runtime implementation wiring was not sampled, so uncertain internal call edges are omitted.
Main entry points: DynamoDbEncryptionInterceptor.java DynamoDB interceptor · EncryptionMaterialsProvider.java Materials providers · DynamoDbEnhancedTableEncryptionConfig.java Enhanced table config · DirectKmsMaterialProvider.java Direct KMS provider
Components 21
DynamoDB integration
- DynamoDB interceptor
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionInterceptor.java - Execution attribute
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionExecutionAttribute.java - Enhanced table config
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedTableEncryptionConfig.java - Enhanced client
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedClientEncryption.java - Attribute tags
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/EncryptionAttributeTags.java
Encryption runtime
- Item encryptor
DynamoDbEncryption/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/DynamoDbItemEncryptor.java - Legacy encryptor
DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/DynamoDBEncryptor.java - DynamoDB signer
DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/DynamoDbSigner.java - Encryption context
DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/EncryptionContext.java - Query transforms
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/transforms/internaldafny/__default.java - Branch key supplier
DynamoDbEncryption/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbKeyBranchKeyIdSupplier.java
Key materials
- Materials providers
DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/EncryptionMaterialsProvider.java - Direct KMS provider
DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/DirectKmsMaterialProvider.java - Cryptographic materials
DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/materials/CryptographicMaterials.java - Caching provider
DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/CachingMostRecentProvider.java
Dafny interfaces
- DynamoDB interfaces
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/internaldafny/__default.java - Item interfaces
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/internaldafny/__default.java - Structured interfaces
DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/structuredencryption/internaldafny/__default.java
Other components
- Application
- DynamoDB
- AWS KMS
Connections 8
- Application → DynamoDB interceptor: uses
- DynamoDB interceptor → DynamoDB: intercepts requests
- Application → Enhanced client: configures tables
- Enhanced table config → Attribute tags: defines handling
- Application → Legacy encryptor: may use legacy API
- Materials providers → Cryptographic materials: supplies materials
- Direct KMS provider → AWS KMS: uses optionally
- Caching provider → Materials providers: caches provider