ToolUp.Encryption.AwsKms 0.22.0

Prefix Reserved
.NET 10.0 This package targets .NET 10.0. The package is compatible with this framework or higher. 
dotnet add package ToolUp.Encryption.AwsKms --version 0.22.0
                    


                    

                
NuGet\Install-Package ToolUp.Encryption.AwsKms -Version 0.22.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="ToolUp.Encryption.AwsKms" Version="0.22.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="ToolUp.Encryption.AwsKms" Version="0.22.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="ToolUp.Encryption.AwsKms" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add ToolUp.Encryption.AwsKms --version 0.22.0
                    


                    

                
#r "nuget: ToolUp.Encryption.AwsKms, 0.22.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package ToolUp.Encryption.AwsKms@0.22.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=ToolUp.Encryption.AwsKms&version=0.22.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=ToolUp.Encryption.AwsKms&version=0.22.0
                    


                            Install as a Cake Tool

ToolUp.Encryption.AwsKms

AWS KMS-backed IBlobEncryptionKeyResolver for ToolUp.Platform (Phase 22a). Envelope encryption: the deployment's KMS customer master key (CMK) never leaves AWS. Each blob is encrypted with its own AES-256 data key (DEK) minted by GenerateDataKey; the CMK-wrapped DEK ciphertext is stamped into the blob envelope's KeyId, and a later read unwraps it via Decrypt. The resolver holds no key state between calls (GP 12 rule 4).

Mirrors src/Storage/<Provider>/ packaging. Server-only companion.

Quick start

open Amazon.KeyManagementService
open ToolUp.Encryption.AwsKms

let kms = new AmazonKeyManagementServiceClient() // region + creds from the env
let resolver = AwsKmsKeyResolver.create kms "arn:aws:kms:eu-west-2:...:key/<cmk>"
// wire via ServerApp.withEncryptedBlobStorage resolver

Per-scope CMKs (multi-tenant key custody):

let resolver = AwsKmsKeyResolver.createPerScope kms (fun scope -> cmkArnFor scope.ScopeId)

Behaviour

  • ResolveKey scope → GenerateDataKey(CMK, AES_256); returns the plaintext DEK + a KeyId of aws-kms:v1:{base64(wrappedDEK)}.
  • ResolveKeyById keyId → unwrap + Decrypt. A disabled / pending- deletion / deleted CMK surfaces as KeyResolutionError.KeyDestroyed (HTTP 410 Gone at the API boundary — crypto-shred); an unknown key as KeyNotFound; transient failures as StorageFailure.

Verification

The resolver requires a live KMS CMK (no offline fake — KMS has no local emulator and IAmazonKeyManagementService is not practically mockable). Verify against a real CMK:

  1. Create a symmetric KMS key; grant the deployment role kms:GenerateDataKey + kms:Decrypt.
  2. ResolveKey → encrypt a blob → ResolveKeyById round-trips the DEK.
  3. Disable the CMK → ResolveKeyById returns KeyDestroyed.

Follow-ups (Phase 22a)

  • Azure Key Vault + GCP KMS mirror resolvers (src/Encryption/{AzureKeyVault,GoogleCloudKms}/).
  • The Phase 40 KMS-signing flavour (IArtefactSigner backed by KMS asymmetric Sign, key never in process memory).

License

Apache-2.0.

Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
0.22.0 105 8/27/2026
0.21.0 113 8/26/2026
0.20.1 100 8/20/2026
0.20.0 126 8/19/2026