Document Unhandled Shallow Ignored Configs

.github/workflows/ci_test_net.yml

@@ -26,7 +26,8 @@ on:
 jobs:
   testDotNet:
     # Don't run the nightly build on forks
-    if: github.event_name != 'schedule' || github.repository_owner == 'awslabs'
+    # Disabled until we reintroduce DynamoDbEncryption, since a matrix vector cannot be empty
+    if: false && (github.event_name != 'schedule' || github.repository_owner == 'awslabs')
     strategy:
       matrix:
         library: [

DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedClientEncryption.java

@@ -3,13 +3,16 @@
 import java.util.*;
 import java.util.stream.Collectors;
 
+import software.amazon.awssdk.enhanced.dynamodb.IndexMetadata;
+import software.amazon.awssdk.enhanced.dynamodb.KeyAttributeMetadata;
+import software.amazon.awssdk.enhanced.dynamodb.TableMetadata;
 import software.amazon.awssdk.enhanced.dynamodb.AttributeConverter;
 import software.amazon.awssdk.enhanced.dynamodb.TableSchema;
 
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.DynamoDbEncryptionInterceptor;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbEncryptionException;
-import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTableEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTablesEncryptionConfig;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTableEncryptionConfig;
 
 import software.amazon.cryptography.dbencryptionsdk.structuredencryption.model.CryptoAction;
 
@@ -31,11 +34,33 @@ public static DynamoDbEncryptionInterceptor CreateDynamoDbEncryptionInterceptor(
                 .build();
     }
 
+    private static Set<String> attributeNamesUsedInIndices(
+        final TableMetadata tableMetadata
+    ) {
+        Set<String> partitionAttributeNames = tableMetadata.indices().stream()
+            .map(IndexMetadata::partitionKey)
+            .filter(Optional::isPresent)
+            .map(Optional::get)
+            .map(KeyAttributeMetadata::name)
+            .collect(Collectors.toSet());
+        Set<String> sortAttributeNames = tableMetadata.indices().stream()
+            .map(IndexMetadata::sortKey)
+            .filter(Optional::isPresent)
+            .map(Optional::get)
+            .map(KeyAttributeMetadata::name)
+            .collect(Collectors.toSet());
+        Set<String> allIndexAttributes = new HashSet<>();
+        allIndexAttributes.addAll(partitionAttributeNames);
+        allIndexAttributes.addAll(sortAttributeNames);
+        return allIndexAttributes;
+    }
+
     private static DynamoDbTableEncryptionConfig getTableConfig(DynamoDbEnhancedTableEncryptionConfig configWithSchema) {
         Map<String, CryptoAction> actions = new HashMap<>();
+
         Set<String> signOnlyAttributes = configWithSchema.schemaOnEncrypt().tableMetadata().customMetadataObject(CUSTOM_DDB_ENCRYPTION_SIGN_ONLY_PREFIX, Set.class).orElseGet(HashSet::new);
         Set<String> doNothingAttributes = configWithSchema.schemaOnEncrypt().tableMetadata().customMetadataObject(CUSTOM_DDB_ENCRYPTION_DO_NOTHING_PREFIX, Set.class).orElseGet(HashSet::new);
-        Set<String> keyAttributes = configWithSchema.schemaOnEncrypt().tableMetadata().keyAttributes().stream().map(val -> val.name()).collect(Collectors.toSet());
+        Set<String> keyAttributes = attributeNamesUsedInIndices(configWithSchema.schemaOnEncrypt().tableMetadata());
 
         if (!Collections.disjoint(keyAttributes, doNothingAttributes)) {
             throw DynamoDbEncryptionException.builder()
@@ -61,6 +86,7 @@ private static DynamoDbTableEncryptionConfig getTableConfig(DynamoDbEnhancedTabl
                 actions.put(attributeName, CryptoAction.ENCRYPT_AND_SIGN);
             }
 
+            // Detect Encryption Flags that are Ignored b/c they are in a Nested Class
             scanForIgnoredEncryptionTagsShallow(configWithSchema, attributeName);
         }
 
@@ -103,7 +129,14 @@ private static DynamoDbTableEncryptionConfig getTableConfig(DynamoDbEnhancedTabl
      * DynamoDB Encryption Tags in Nested Classes are IGNORED by the
      * Database Encryption SDK for DynamoDB.<p>
      * As such, Detection of a nested DynamoDB Encryption Tag on a Nested Type
-     * triggers a Runtime Exception that MUST NOT BE ignored.
+     * triggers a Runtime Exception that MUST NOT BE ignored.<p>
+     * CAVEAT: Encryption Tags on fields of Nested Classes that are
+     * Flattened onto the top record are Respected.<p>
+     * The behavior of Flatten pushes the Attributes onto the top level record,
+     * making the "flattened sub-fields" equivalent to any other DynamoDB Attribute.<p>
+     * However, there still exists a possibility for IGNORED Encryption Tags,
+     * as any Encryption Tag on the field that will be "flattened" is ignored.<p>
+     * This method DOES NOT detect these "ignored-by-flattened" tags.
      */
     private static void scanForIgnoredEncryptionTagsShallow(
         final DynamoDbEnhancedTableEncryptionConfig configWithSchema,

DynamoDbEncryption/runtimes/java/src/test/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEncryptionEnhancedClientIntegrationTests.java

@@ -187,53 +187,6 @@ public void TestPutAndGetAnnotatedConvertedBy() {
         assertEquals(result.getNestedEncrypted(), record.getNestedEncrypted());
         assertEquals(result.getNestedSigned(), record.getNestedSigned());
     }
-
-    @Test
-    public void TestPutAndGetConflictingFlattenedBean() {
-        final String PARTITION = "ConflictingFlattenedBean";
-        final int SORT = 20230713;
-        TableSchema<ConflictingFlattenedBean> schemaOnEncrypt =
-            TableSchema.fromBean(ConflictingFlattenedBean.class);
-        List<String> allowedUnsignedAttributes = Arrays.asList(
-            "lastName",
-            "anotherLastName",
-            "finalLastName");
-        DynamoDbEnhancedClient enhancedClient =
-            initEnhancedClientWithInterceptor(schemaOnEncrypt, allowedUnsignedAttributes, null, null);
-
-        DynamoDbTable<ConflictingFlattenedBean> table = enhancedClient.table(TEST_TABLE_NAME, schemaOnEncrypt);
-
-        ConflictingFlattenedBean record = new ConflictingFlattenedBean();
-        record.setPartitionKey(PARTITION);
-        record.setSortKey(SORT);
-        record.setNestedEncrypted(new ConflictingFlattenedBean.NestedBean (
-            "9305B367-C477-4A58-9E6C-BF7D59D17C8A", "Moe", "Howard"
-        ));
-        record.setNestedIgnored(new ConflictingFlattenedBean.FinalNestedBean (
-            "9305B367-C477-4A58-9E6C-BF7D59D17C8A", "Larry", "Fine"
-        ));
-        record.setNestedSigned(new ConflictingFlattenedBean.AnotherNestedBean (
-            "9305B367-C477-4A58-9E6C-BF7D59D17C8A", "Curly", "Howard"
-        ));
-
-        // Put an item into an Amazon DynamoDB table.
-        table.putItem(record);
-        // table.deleteItem(record);
-
-        // Get the item back from the table
-        Key key = Key.builder()
-            .partitionValue(PARTITION).sortValue(SORT)
-            .build();
-
-        // Get the item by using the key.
-        ConflictingFlattenedBean result = table.getItem(
-            (GetItemEnhancedRequest.Builder requestBuilder) -> requestBuilder.key(key));
-        assertEquals(result.getPartitionKey(), record.getPartitionKey());
-        assertEquals(result.getSortKey(), record.getSortKey());
-        assertEquals(result.getNestedIgnored(), record.getNestedIgnored());
-        assertEquals(result.getNestedEncrypted(), record.getNestedEncrypted());
-        assertEquals(result.getNestedSigned(), record.getNestedSigned());
-    }
 
     @Test
     public void TestPutAndGetSignOnly() {

DynamoDbEncryption/runtimes/java/src/test/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedClientEncryptionTest.java

@@ -319,28 +319,13 @@ public void TestConflictingAnnotatedNestedBean() {
     }
 
     @Test(
-        // This test SHOULD yield an exception, but does not, at this time.
-        // expectedExceptions = DynamoDbEncryptionException.class
-    )
-    public void TestInvalidAnnotatedConvertedByAnnotationsOnNonAttributes() {
-        TableSchema<InvalidAnnotatedConvertedBy> schemaOnEncrypt =
-            TableSchema.fromBean(InvalidAnnotatedConvertedBy.class);
-        Map<String, DynamoDbEnhancedTableEncryptionConfig> tableConfigs = new HashMap<>();
-        tableConfigs.put(TEST_TABLE_NAME,
-            DynamoDbEnhancedTableEncryptionConfig.builder()
-                .logicalTableName(TEST_TABLE_NAME)
-                .keyring(createKmsKeyring())
-                .schemaOnEncrypt(schemaOnEncrypt)
-                .build());
-        DynamoDbEnhancedClientEncryption.CreateDynamoDbEncryptionInterceptor(
-            CreateDynamoDbEncryptionInterceptorInput.builder()
-                .tableEncryptionConfigs(tableConfigs)
-                .build());
-    }
-
-    @Test(
-        // This test SHOULD yield an exception, but does not, at this time.
-        // expectedExceptions = DynamoDbEncryptionException.class
+        // We skip this Test.
+        enabled = false,
+        // The DB-ESDK-DynamoDB for Java SHOULD detect ALL DynamoDBEncryption
+        // Tags & Attributes that are IGNORED and throw an Exception.
+        // However, detecting IGNORED DynamoDBEncryption Tags & Attributes
+        // when a nested class is Flattened has NOT been implemented.
+        expectedExceptions = DynamoDbEncryptionException.class
     )
     public void TestConflictingFlattenedBean() {
         TableSchema<ConflictingFlattenedBean> schemaOnEncrypt =