Package org.apache.iceberg.encryption

Class StandardEncryptionManager

java.lang.Object

org.apache.iceberg.encryption.StandardEncryptionManager

All Implemented Interfaces:

Serializable, EncryptionManager

public class StandardEncryptionManager
extends Object
implements EncryptionManager

See Also:

• Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	StandardEncryptionManager.FileEncryptionKeys	Encrypted key metadata and its wrapping key.

Constructor Summary

Constructors

Constructor	Description
StandardEncryptionManager(List<EncryptedKey> keys, String tableKeyId, int dataKeyLength, KeyManagementClient kmsClient)

Method Summary

Modifier and Type	Method	Description
String	addManifestListKeyMetadata(NativeEncryptionKeyMetadata keyMetadata)	Deprecated. since 1.12.0, will be removed in 1.13.0; use registerKeyMetadata(NativeEncryptionKeyMetadata) instead.
Iterable<InputFile>	decrypt(Iterable<EncryptedInputFile> encrypted)	Variant of EncryptionManager.decrypt(EncryptedInputFile) that provides a sequence of files that all need to be decrypted in a single context.
NativeEncryptionInputFile	decrypt(EncryptedInputFile encrypted)	Given an EncryptedInputFile.encryptedInputFile() representing the raw encrypted bytes from the underlying file system, and given metadata about how the file was encrypted via EncryptedInputFile.keyMetadata(), return an InputFile that returns decrypted input streams.
NativeEncryptionOutputFile	encrypt(OutputFile plainOutput)	Given a handle on an OutputFile that writes raw bytes to the underlying file system, return a bundle of an EncryptedOutputFile.encryptingOutputFile() that writes encrypted bytes to the underlying file system, and the EncryptedOutputFile.keyMetadata() that points to the encryption key that is being used to encrypt this file.
StandardEncryptionManager.FileEncryptionKeys	registerKeyMetadata(NativeEncryptionKeyMetadata keyMetadata)	Encrypts and registers key metadata.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.iceberg.encryption.EncryptionManager

encrypt

Constructor Details

StandardEncryptionManager

public StandardEncryptionManager(List<EncryptedKey> keys,
 String tableKeyId,
 int dataKeyLength,
 KeyManagementClient kmsClient)

Parameters:

keys - encryption keys from table metadata

tableKeyId - table encryption key id

dataKeyLength - length of data encryption key (16/24/32 bytes)

kmsClient - Client of KMS used to wrap/unwrap keys in envelope encryption

Method Details

encrypt

public NativeEncryptionOutputFile encrypt(OutputFile plainOutput)

Description copied from interface: EncryptionManager

Given a handle on an OutputFile that writes raw bytes to the underlying file system, return a bundle of an EncryptedOutputFile.encryptingOutputFile() that writes encrypted bytes to the underlying file system, and the EncryptedOutputFile.keyMetadata() that points to the encryption key that is being used to encrypt this file.

Specified by:

encrypt in interface EncryptionManager

decrypt

public NativeEncryptionInputFile decrypt(EncryptedInputFile encrypted)

Description copied from interface: EncryptionManager

Given an EncryptedInputFile.encryptedInputFile() representing the raw encrypted bytes from the underlying file system, and given metadata about how the file was encrypted via EncryptedInputFile.keyMetadata(), return an InputFile that returns decrypted input streams.

Specified by:

decrypt in interface EncryptionManager

decrypt

public Iterable<InputFile> decrypt(Iterable<EncryptedInputFile> encrypted)

Description copied from interface: EncryptionManager

Variant of EncryptionManager.decrypt(EncryptedInputFile) that provides a sequence of files that all need to be decrypted in a single context.

By default this calls the single-file decryption method for each element in the iterator. Implementations can override this for a variety of optimizations. For example, an implementation can perform lookahead on the input iterator and fetch encryption keys in batch.

Specified by:

decrypt in interface EncryptionManager

addManifestListKeyMetadata

@Deprecated
public String addManifestListKeyMetadata(NativeEncryptionKeyMetadata keyMetadata)

Deprecated.

since 1.12.0, will be removed in 1.13.0; use registerKeyMetadata(NativeEncryptionKeyMetadata) instead.

Encrypts and registers manifest-list key metadata.

Returns:

the ID of the encrypted metadata

registerKeyMetadata

public StandardEncryptionManager.FileEncryptionKeys registerKeyMetadata(NativeEncryptionKeyMetadata keyMetadata)

Encrypts and registers key metadata.

Returns:

the encrypted metadata and its wrapping key