giuseppe-trisciuoglio/aws-sdk-java-v2-kms

¿Qué hace aws-sdk-java-v2-kms?

Proporciona patrones del Servicio de Gestión de Claves (KMS) de AWS utilizando el SDK de AWS para Java 2.x. Se usa al crear/gestionar claves de cifrado, cifrar/descifrar datos, generar claves de datos, firmas digitales, rotación de claves o integrar cifrado en aplicaciones Spring Boot.

Requisitos previos

• SDK de AWS para Java 2.x (software.amazon.awssdk:kms)
• Credenciales de AWS configuradas (variables de entorno AWS_ACCESS_KEY_ID y AWS_SECRET_ACCESS_KEY, o perfil de IAM)
• Región de AWS configurada (AWS_REGION)

Dependencia Maven

<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>kms</artifactId>
</dependency>

Dependencia Gradle

implementation 'software.amazon.awssdk:kms'

Ejemplos de uso

Crear cliente KMS

import software.amazon.awssdk.services.kms.KmsClient;

KmsClient kmsClient = KmsClient.create();

Crear clave simétrica

import software.amazon.awssdk.services.kms.model.*;

CreateKeyRequest req = CreateKeyRequest.builder()
        .keyUsage(KeyUsageType.ENCRYPT_DECRYPT)
        .origin(OriginType.AWS_KMS)
        .build();

CreateKeyResponse response = kmsClient.createKey(req);
String keyId = response.keyMetadata().keyId();

Cifrar datos

import software.amazon.awssdk.core.SdkBytes;

EncryptRequest req = EncryptRequest.builder()
        .keyId(keyId)
        .plaintext(SdkBytes.fromUtf8String("Contenido secreto"))
        .build();

EncryptResponse response = kmsClient.encrypt(req);
SdkBytes ciphertextBlob = response.ciphertextBlob();

Descifrar datos

DecryptRequest req = DecryptRequest.builder()
        .ciphertextBlob(ciphertextBlob)
        .build();

DecryptResponse response = kmsClient.decrypt(req);
String plaintext = response.plaintext().asUtf8String();

Generar clave de datos

GenerateDataKeyRequest req = GenerateDataKeyRequest.builder()
        .keyId(keyId)
        .keySpec(DataKeySpec.AES_256)
        .build();

GenerateDataKeyResponse response = kmsClient.generateDataKey(req);
SdkBytes plaintextKey = response.plaintext();
SdkBytes encryptedKey = response.ciphertextBlob();

Firmar digitalmente

SignRequest req = SignRequest.builder()
        .keyId(keyId)
        .message(SdkBytes.fromUtf8String("Mensaje a firmar"))
        .signingAlgorithm(SigningAlgorithmSpec.RSASSA_PKCS1_V1_5_SHA_256)
        .build();

SignResponse response = kmsClient.sign(req);
SdkBytes signature = response.signature();

Rotación de claves

EnableKeyRotationRequest req = EnableKeyRotationRequest.builder()
        .keyId(keyId)
        .build();

kmsClient.enableKeyRotation(req);

Integración con Spring Boot

Configuración en application.yml

aws:
  kms:
    region: us-east-1
    access-key: ${AWS_ACCESS_KEY_ID}
    secret-key: ${AWS_SECRET_ACCESS_KEY}

Bean de configuración

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import software.amazon.awssdk.services.kms.KmsClient;

@Configuration
public class KmsConfig {

    @Bean
    public KmsClient kmsClient() {
        return KmsClient.create();
    }
}

Uso en un servicio

import org.springframework.stereotype.Service;

@Service
public class EncryptionService {

    private final KmsClient kmsClient;

    public EncryptionService(KmsClient kmsClient) {
        this.kmsClient = kmsClient;
    }

    public byte[] encrypt(String keyId, String plaintext) {
        EncryptRequest req = EncryptRequest.builder()
                .keyId(keyId)
                .plaintext(SdkBytes.fromUtf8String(plaintext))
                .build();
        return kmsClient.encrypt(req).ciphertextBlob().asByteArray();
    }
}

Referencias

• Documentación oficial de AWS KMS
• Guía del usuario de AWS SDK for Java 2.x