Using the DynamoDB Encryption Client for Java

To specify attribute actions when you use the DynamoDBEncryptor directly, create a HashMap object in which the name-value pairs represent attribute names and the specified actions.

The valid values are for the attribute actions are defined in the EncryptionFlags enumerated type. You can use ENCRYPT and SIGN together, use SIGN alone, or omit both. However, if you use ENCRYPT alone, the DynamoDB Encryption Client throws an error. You cannot encrypt an attribute that you don't sign.

ENCRYPT
SIGN

If you specify a primary key in the encryption context and then specify ENCRYPT in the attribute action for either primary key attribute, the DynamoDB Encryption Client throws an exception.

For example, the following Java code creates an actions HashMap that encrypts and signs all attributes in the record item. The exceptions are the partition key and sort key attributes, which are signed but not encrypted, and the test attribute, which is not signed or encrypted.

final EnumSet<EncryptionFlags> signOnly = EnumSet.of(EncryptionFlags.SIGN);
final EnumSet<EncryptionFlags> encryptAndSign = EnumSet.of(EncryptionFlags.ENCRYPT, EncryptionFlags.SIGN);
final Map<String, Set<EncryptionFlags>> actions = new HashMap<>();

for (final String attributeName : record.keySet()) {
  switch (attributeName) {
    case partitionKeyName: // no break; falls through to next case
    case sortKeyName:
      // Partition and sort keys must not be encrypted, but should be signed
      actions.put(attributeName, signOnly);
      break;
    case "test":
      // Don't encrypt or sign
      break;
    default:
      // Encrypt and sign everything else
      actions.put(attributeName, encryptAndSign);
      break;
  }
}

Then, when you call the encryptRecord method of the DynamoDBEncryptor, specify the map as the value of the attributeFlags parameter. For example, this call to encryptRecord uses the actions map.

// Encrypt the plaintext record
final Map<String, AttributeValue> encrypted_record = encryptor.encryptRecord(record, actions, encryptionContext);