AWS KMS using Java

Introduction

AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses FIPS 140-2 validated hardware security modules to protect the security of your keys. AWS Key Management Service is integrated with most other AWS services to help you protect the data you store with these services. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.

 

 

Using AWS Key Management Service (KMS) with java will be very simple by just following the below steps.

---

Adding Dependency JAR

We need the below aws-java-sdk JAR to be copied into our classpath for creating the Spring component.

<dependency>
	<groupid>com.amazonaws</groupid>
	<artifactid>aws-java-sdk</artifactid>
	<version>1.11.25</version>
</dependency>

Code the Java Controller

Below would be the KMS implementation that can be used as a Java class @Component while using with Spring

import java.nio.ByteBuffer;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.env.Environment;
import org.springframework.stereotype.Component;

import com.amazonaws.services.kms.AWSKMS;
import com.amazonaws.services.kms.model.DecryptRequest;
import com.amazonaws.services.kms.model.DecryptResult;
import com.amazonaws.services.kms.model.EncryptRequest;
import com.amazonaws.util.Base64;
@Component
public class AWSEncryption {

  @Autowired
  private AWSKMS AWSKMS_CLIENT;

  public AWSEncryption() {
  }

  public String encrypt(String data) {

    ByteBuffer plaintext = ByteBuffer.wrap(data.getBytes());

    EncryptRequest req = new EncryptRequest().withKeyId(env.getProperty("YOUR_KMS_KEY")).withPlaintext(plaintext);

    ByteBuffer ciphertext = AWSKMS_CLIENT.encrypt(req).getCiphertextBlob();

    byte[] base64EncodedValue = Base64.encode(ciphertext.array());

    String value = new String(base64EncodedValue, Charset.forName("UTF-8"));

    return value;
  }

  public String decrypt(String data) {

    byte[] base64EncodedValue = Base64.decode(data);

    ByteBuffer plaintext = ByteBuffer.wrap(base64EncodedValue);

    DecryptRequest dereq = new DecryptRequest().withCiphertextBlob(plaintext);

    DecryptResult de = AWSKMS_CLIENT.decrypt(dereq);

    String decryptedData = StandardCharsets.UTF_8.decode(de.getPlaintext()).toString();

    return decryptedData;
  }

}

---

Using the utility functions of encrypt and decrypt

We now can make calls to the above-mentioned java functions to encrypt and decrypt like below

Injecting the component

// inject the component
 @Autowired
 private AWSEncryption awsEncryption;

calling encrypt

awsEncryption.encrypt("Some string we want to encrypt")

calling decrypt

awsEncryption.decrypt("THE_ENCRYPTED_KEY")