Ergonomic envelope encryption for Elixir - a vault module, pluggable key providers, and per-tenant keys - on the aws_encryption_sdk engine.
The engine already does the cryptography correctly. What it does not do is make the everyday shape of the job pleasant: standing up a client, holding a keyring, deciding which key a given tenant's data belongs to, rotating that key without rewriting call sites. This package is that layer - a supervised vault a host configures once and then calls, with key material resolved through a provider rather than hard-wired at the call site.
Ciphertexts carry the AWS Encryption SDK message format, so anything written here is readable by the official ESDKs in any language.
Two guides are the way in: guides/getting-started.md stands up a
single-key vault and then a per-tenant one, and guides/rotation-runbook.md
is the four operator procedures and what each of them destroys.
This module exists so the package has a root; the vault surface, the key-provider behaviour, the per-tenant envelope, the encryption-context convention and the rotation model each have an accepted decision record behind them.
Encryptor.Error is the first of those contracts in code: the one error
struct every entry point returns, and the closed vocabulary of reasons it
carries. Encryptor.Kdf is the second: HKDF-SHA256 expansion into the
labelled subkeys the key hierarchy is built from. Encryptor.Key is the
third: the closed set of key descriptors a provider answers a selector with,
and which the vault alone turns into an engine keyring.
Encryptor.Vault is the surface those contracts meet at: use Encryptor.Vault, otp_app: :my_app defines a supervised vault, resolves and
freezes its configuration at start, and answers a vault that is not running
with a typed error rather than an exit from inside a library. Its
encrypt/2, decrypt/2 and rekey/2 entry points are the whole of the
everyday surface.
Encryptor.Envelope is the level 1 to level 2 relationship above that
surface: how a tenant master key is minted, what protects it at rest, and
how it gets back into memory. Encryptor.Message.describe/1 reads what a
stored message says about itself, without a key and without verifying it.