aws-kms-ee/lib/connector.js

AWS KMS Envelope Encryption

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});

var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; /* eslint import/no-extraneous-dependencies: ["error", {"devDependencies": true}] */


var _bluebird = require('bluebird');

var _bluebird2 = _interopRequireDefault(_bluebird);

var _memoryCache = require('memory-cache');

var _memoryCache2 = _interopRequireDefault(_memoryCache);

var _https = require('https');

var _clientKms = require('@aws-sdk/client-kms');

var _nodeHttpHandler = require('@smithy/node-http-handler');

var _utils = require('./utils');

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new _bluebird2.default(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return _bluebird2.default.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }

const cache = new _memoryCache2.default.Cache();

class Connector {
  constructor(masterKeyAlias, region = process.env.AWS_REGION, timeout = Number(process.env.KMS_TIMEOUT || process.env.TIMEOUT || 1000), connectTimeout = Number(process.env.KMS_CONNECT_TIMEOUT || process.env.CONNECT_TIMEOUT || 1000), maxAge = Number(process.env.DATA_KEY_MAX_AGE) || undefined, // default to life of lambda function
  maxSockets = Number(process.env.MAX_SOCKETS) || 50) {
    this.maxAge = maxAge;
    this.masterKeyAlias = masterKeyAlias;
    this.kms = Connector.getKmsClient(timeout, connectTimeout, maxSockets, region);
  }

  static getKmsClient(timeout, connectTimeout, maxSockets, region) {
    if (!this.kmsClient[region]) {
      this.kmsClient[region] = new _clientKms.KMSClient({
        requestHandler: new _nodeHttpHandler.NodeHttpHandler({
          requestTimeout: timeout,
          connectionTimeout: connectTimeout,
          httpsAgent: new _https.Agent({
            maxSockets
          })
        }),
        logger: (0, _utils.getClientLogger)(),
        region
      });
    }
    return this.kmsClient[region];
  }

  generateDataKey() {
    return this.getput('datakey', () => this._sendCommand(new _clientKms.GenerateDataKeyCommand({
      KeyId: this.masterKeyAlias,
      KeySpec: 'AES_256'
    })).then(response => _extends({}, response, {
      // maintaining backwards compatibility with sdk v2
      CiphertextBlob: Buffer.from(response.CiphertextBlob),
      Plaintext: Buffer.from(response.Plaintext)
    })));
  }

  decryptDataKey(dataKey) {
    return this.getput(dataKey, dk => this._sendCommand(new _clientKms.DecryptCommand({
      CiphertextBlob: Buffer.from(dk, 'base64')
    })).then(response => _extends({}, response, {
      // maintaining backwards compatibility with sdk v2
      Plaintext: Buffer.from(response.Plaintext)
    })));
  }

  encryptDataKey(plainText) {
    return this.getput(plainText, pt => this._sendCommand(new _clientKms.EncryptCommand({
      KeyId: this.masterKeyAlias,
      Plaintext: pt
    })).then(response => _extends({}, response, {
      // maintaining backwards compatibility with sdk v2
      CiphertextBlob: Buffer.from(response.CiphertextBlob)
    })));
  }

  getput(data, f) {
    var _this = this;

    return _asyncToGenerator(function* () {
      let k = cache.get(data);
      if (!k) {
        k = yield f(data);
        cache.put(data, k, _this.maxAge);
      }
      return _bluebird2.default.resolve(k);
    })();
  }

  _sendCommand(command) {
    // Wrap in bluebird promise for things like tap and tapCatch downstream.
    return _bluebird2.default.resolve(this.kms.send(command));
  }
}

Connector.kmsClient = [];
exports.default = Connector;