kmsjwt

README

kmsjwt

This little utility library provides an AWS KMS-based implementation of jwt.SigningMethod.

You will be using an instance of context.Context as the encryption key.

Documentation

Index

• type KMS
• type KMSJWT
  • func New(ctx context.Context, client KMS, keyID string) (KMSJWT, error)
  • func (k KMSJWT) Alg() string
  • func (k KMSJWT) Sign(signingString string, key interface{}) (string, error)
  • func (k KMSJWT) Verify(signingString, stringSignature string, key interface{}) error

Types

type KMS

type KMS interface {
	GetPublicKey(context.Context, *kms.GetPublicKeyInput, ...func(*kms.Options)) (*kms.GetPublicKeyOutput, error)
	Sign(context.Context, *kms.SignInput, ...func(*kms.Options)) (*kms.SignOutput, error)
}

KMS defines a small part of the AWS KMS interface, that is required by the signer to work.

type KMSJWT

type KMSJWT struct {
	// contains filtered or unexported fields
}

KMSJWT is a JWT signing method implementation using an asymmetric AWS KMS key. The signing is done by KMS service, so there is a network call on every sign action. The verification is done on the client side with the exported public key. The public key is retrieved from KMS on initialization.

func New

func New(ctx context.Context, client KMS, keyID string) (KMSJWT, error)

New retrieves the public key from KMS and returns a signer.

func (KMSJWT) Alg

func (k KMSJWT) Alg() string

Alg returns the signing algorithm as defined in https://datatracker.ietf.org/doc/html/rfc7518#section-3.1.

func (KMSJWT) Sign

func (k KMSJWT) Sign(signingString string, key interface{}) (string, error)

Sign signs the signingString with AWS KMS using the key ID stored on the object. The key parameter expects a context.Context that is used for the network call to KMS.

func (KMSJWT) Verify

func (k KMSJWT) Verify(signingString, stringSignature string, key interface{}) error

Verify verifies that the signature is valid for the signingString. The verification is done on the client side using the rsa.PublicKey stored on the object. For the key parameter a context.Context is expected.