Skip to content

Commit

Permalink
Polishing few things
Browse files Browse the repository at this point in the history
  • Loading branch information
leandrodamascena committed Feb 1, 2024
1 parent 9d1d1e9 commit 581145d
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 20 deletions.
46 changes: 26 additions & 20 deletions docs/utilities/data_masking.md
Original file line number Diff line number Diff line change
Expand Up @@ -109,14 +109,14 @@ Erasing will remove the original data and replace it with a `*****`. This means
1. See [working with nested data](#working-with-nested-data) to learn more about the `fields` parameter. </br></br>If we omit `fields` parameter, the entire dictionary will be erased with `*****`.

=== "generic_data_input.json"
```json hl_lines="7 9 14"
--8<-- "examples/data_masking/src/generic_data_input.json"
```
```json hl_lines="7 9 14"
--8<-- "examples/data_masking/src/generic_data_input.json"
```

=== "getting_started_erase_data_output.json"
```json hl_lines="5 7 12"
--8<-- "examples/data_masking/src/getting_started_erase_data_output.json"
```
```json hl_lines="5 7 12"
--8<-- "examples/data_masking/src/getting_started_erase_data_output.json"
```

### Encrypting data

Expand All @@ -135,14 +135,14 @@ Under the hood, we delegate a [number of operations](#encrypt-operation-with-enc
1. You can use more than one KMS Key for higher availability but increased latency. </br></br>Encryption SDK will ensure the data key is encrypted with both keys.

=== "generic_data_input.json"
```json hl_lines="7-9 14"
--8<-- "examples/data_masking/src/generic_data_input.json"
```
```json
--8<-- "examples/data_masking/src/generic_data_input.json"
```

=== "encrypt_data_output.json"
```json hl_lines="5-7 12"
--8<-- "examples/data_masking/src/encrypt_data_output.json"
```
```json
--8<-- "examples/data_masking/src/encrypt_data_output.json"
```

### Decrypting data

Expand All @@ -164,21 +164,23 @@ Under the hood, we delegate a [number of operations](#decrypt-operation-with-enc
1. Note that KMS key alias or key ID won't work.
2. You can use more than one KMS Key for higher availability but increased latency. </br></br>Encryption SDK will call `Decrypt` API with all master keys when trying to decrypt the data key.

=== "encrypt_data_output.json"
=== "getting_started_decrypt_data_input.json"

```json hl_lines="5-7 12"
--8<-- "examples/data_masking/src/encrypt_data_output.json"
```
```json
--8<-- "examples/data_masking/src/getting_started_decrypt_data_input.json"
```

=== "getting_started_decrypt_data_output.json"

```json hl_lines="5-7 12-17"
--8<-- "examples/data_masking/src/getting_started_decrypt_data_output.json"
```
```json
--8<-- "examples/data_masking/src/getting_started_decrypt_data_output.json"
```

### Encryption context for integrity and authenticity

<!-- markdownlint-disable MD013 -->
For a stronger security posture, you can add metadata to each encryption operation, and verify them during decryption. This is known as additional authenticated data (AAD). These are non-sensitive data that can help protect authenticity and integrity of your encrypted data, and even help to prevent a [confused deputy](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html){target="_blank"} situation.
<!-- markdownlint-enable MD013 -->

???+ danger "Important considerations you should know"
1. **Exact match verification on decrypt**. Be careful using random data like `timestamps` as encryption context if you can't provide them on decrypt.
Expand All @@ -205,7 +207,7 @@ For a stronger security posture, you can add metadata to each encryption operati

???+ note "Current limitations"
1. The `fields` parameter is currently exclusive to the `erase` method, with potential future inclusion into `encrypt` and `decrypt`.
2. We support `JSON` data types only - see [data serialization for more details](#data-serialization-and-preservation)."
2. We support `JSON` data types only - see [data serialization for more details](#data-serialization)."

You can use the `fields` parameter with the dot notation `.` to choose one or more parts of your data to `erase`. This is useful when you want to keep data structure intact except the confidential fields.

Expand Down Expand Up @@ -424,6 +426,8 @@ You can modify the following values when initializing the `AWSEncryptionSDKProvi
| **max_messages_encrypted** | `4294967296` | The maximum number of messages that may be encrypted under a cache entry |
| **max_bytes_encrypted** | `9223372036854775807` | The maximum number of bytes that may be encrypted under a cache entry |

If required, you have the option to customize the default values when initializing the `AWSEncryptionSDKProvider` class.

=== "aws_encryption_provider_example.py"

```python hl_lines="14-19"
Expand Down Expand Up @@ -594,11 +598,13 @@ sequenceDiagram
Testing your code with a simple erase operation

=== "test_lambda_mask.py"

```python hl_lines="22"
--8<-- "examples/data_masking/tests/test_lambda_mask.py"
```

=== "lambda_mask.py"

```python hl_lines="3 12"
--8<-- "examples/data_masking/tests/lambda_mask.py"
```
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"body": "AgV4uF5K2YMtNhYrtviTwKNrUHhqQr73l/jNfukkh+qLOC8AXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREEvcjEyaFZHY1R5cjJuTDNKbTJ3UFA3R3ZjaytIdi9hekZqbXVUb25Ya3J5SzFBOUlJZDZxZXpSR1NTVnZDUUxoZz09AAEAB2F3cy1rbXMAS2Fybjphd3M6a21zOnVzLWVhc3QtMToyMDA5ODQxMTIzODY6a2V5LzZkODJiMzRlLTM2NjAtNDRlMi04YWJiLTdmMzA1OGJlYTIxMgC4AQIBAHjxYXAO7wQGd+7qxoyvXAajwqboF5FL/9lgYUNJTB8VtAHBP2hwVgw+zypp7GoMNTPAAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMx/B25MTgWwpL7CmuAgEQgDtan3orAOKFUfyNm3v6rFcglb+BVVVDV71fj4aRljhpg1ixsYFaKsoej8NcwRktIiWE+mw9XmTEVb6xFQIAABAA9DeLzlRaRQgTcXMJG0iBu/YTyyDKiROD+bU1Y09X9RBz5LA1nWIENJKq2seAhNSB/////wAAAAEAAAAAAAAAAAAAAAEAAAEBExLJ9wI4n7t+wyPEEP4kjYFBdkmNuLLsVC2Yt8mv9Y1iH2G+/g9SaIcdK57pkoW0ECpBxZVOxCuhmK2s74AJCUdem9McjS1waUKyzYTi9vv2ySNBsABIDwT990rE7jZJ3tEZAqcWZg/eWlxvnksFR/akBWZKsKzFz6lF57+cTgdISCEJRV0E7fcUeCuaMaQGK1Qw2OCmIeHEG5j5iztBkZG2IB2CVND/AbxmDUFHwgjsrJPTzaDYSufcGMoZW1A9X1sLVfqNVKvnOFP5tNY7kPF5eAI9FhGBw8SjTqODXz4k6zuqzy9no8HtXowP265U8NZ5VbVTd/zuVEbZyK5KBqzP1sExW4RhnlpXMoOs9WSuAGcwZQIxANTeEwb9V7CacV2Urt/oCqysUzhoV2AcT2ZjryFqY79Tsg+FRpIx7cBizL4ieRzbhQIwcRasNncO5OZOcmVr0MqHv+gCVznndMgjXJmWwUa7h6skJKmhhMPlN0CsugxtVWnD"
}

0 comments on commit 581145d

Please sign in to comment.