AWS DynamoDB Encryption - Ruby

Question

Is it possible to set encryption for DynamoDB using Ruby / Ruby on Rails?

Does aws-sdk provide it?

Should I do that on my own?

Or it is not possible?

NOTE: There will be few the same Rails app running parallel and connected to the same DynamoDB.

check out the answer below

Tilo
– Tilo

2018-01-20 09:24:51 +00:00
Commented Jan 20, 2018 at 9:24 — Tilo
– Tilo, Commented Jan 20, 2018 at 9:24

Mark B · Accepted Answer · 2017-02-03 15:01:07Z

1

DynamoDB doesn't encrypt data for you. You would have to handle the encryption and decryption in your DynamoDB client code. There is a Java library for handling this, but I don't see one for Ruby.

Note that DynamoDB won't be able to perform meaningful queries against any fields that you have encrypted.

I would recommend using the AWS KMS service to manage the encryption key that your application uses to encrypt data before it inserts it into DynamoDB.

answered Feb 3, 2017 at 15:01

Mark B

203k27 gold badges339 silver badges332 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Tilo · Accepted Answer · 2018-01-20 09:23:53Z

Encrypting critical fields with AWS KMS works well -- here's an example how to wrap it in a convenient module.

requires gem 'aws-sdk', '~> 2.0'

config/initializers/aws_kms.rb

# Helper for AWS KMS encryption / decryption:
#
# Example:
#
# cipherdata = Aws::KMS.encrypt('boring plain text')
#
# => "AQICAkSXnpkzAJrrzNcjlMxRK78jbKHnkPohQdSZ445Xv29z6C2ty433pG2rcs96IujEj4IXAa1rmSzJXfiQqw4LaFcluh3CYsFQOlOfhgh0LhPdiQhnIP7d0BzlIu3uRFzHLrhIpg2JssVsjnCLZstNkzerfiwYtGSNTpltVjaqJblz3kktSFNxnMoVOcJSlvTbuMdiD9yplGMDD3LC0YKjUZtEZIqEjt=="
#
# Aws::KMS.decrypt( cipherdata )
#
# => "boring plain text"
#
#
# Protects from AWS KMS calls if we are in TEST environment
#
module Aws::KMS

  def self.encrypt(plaintext)
    if Rails.env.test? || Rails.env.development?
      ['not_encrypted_in_test', plaintext].join('|') # faking encryption so we can test this without AWS
    else
      cipherdata = client.encrypt({
        key_id: ENV['KMS_ARN'],
        plaintext: plaintext,
      }).ciphertext_blob
      Base64.strict_encode64(cipherdata)
    end
  end

  def self.decrypt(ciphertext)
    if Rails.env.test? || Rails.env.development?
      ciphertext.split('|').second # faking decryption so we can test this without AWS
    else
      cipherdata = Base64.strict_decode64( ciphertext )

      client.decrypt({
        ciphertext_blob: cipherdata
      }).plaintext
    end
  end

  # this helper method can be called to check if the ENV variables are configured correctly:
  def self.setup_correct?
    plaintext = 'Hey, it works!'
    cipherdata = Aws::KMS.encrypt( plaintext )
    Aws::KMS.decrypt( cipherdata ) == plaintext
  end

  def self.client
    Aws::KMS::Client.new
  end

end

Collectives™ on Stack Overflow

AWS DynamoDB Encryption - Ruby

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related