Modules
Ergonomic envelope encryption for Elixir - a vault module, pluggable key providers, and per-tenant keys - on the aws_encryption_sdk engine.
The encryption context: the canonical vocabulary, the four-layer composition, and the bounds the engine does not check.
The level 1 to level 2 relationship: how a tenant master key comes into existence, what protects it at rest, and how it gets back into memory.
One tenant master key, wrapped, plus the identity a store has to give back.
The one error struct this package returns, and the closed vocabulary of reasons it carries.
HKDF-SHA256 key derivation: the one place this package expands a key into a labelled subkey.
The closed, package-owned set of key descriptors.
A raw AES wrapping key, named.
An AWS KMS key, referenced by id.
The one place this package reads the engine's message format.
What a message says about itself.
The key-provider behaviour: a selector in, key descriptors out.
The shared test suite every Encryptor.Provider implementation is held to.
A provider built from a host-supplied pair of closures.
A provider that holds its keys in configuration.
The vault: a host-owned module that wraps the engine completely.
Bounds a vault's materials cache by throwing the whole table away, on an interval.
A vault's resolved configuration: the five-layer precedence chain, every
check that runs at start, and the :persistent_term freeze the hot path
reads.
Owns the lifetime of a vault's frozen configuration.
Derives the fixed-width cache partition id a vault hands the caching CMM.
The supervisor a vault starts, and the only place a vault has processes.