Lyo.KeyStore.Aws
1.0.9
dotnet add package Lyo.KeyStore.Aws --version 1.0.9
NuGet\Install-Package Lyo.KeyStore.Aws -Version 1.0.9
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Lyo.KeyStore.Aws" Version="1.0.9" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
<PackageVersion Include="Lyo.KeyStore.Aws" Version="1.0.9" />
<PackageReference Include="Lyo.KeyStore.Aws" />
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.
paket add Lyo.KeyStore.Aws --version 1.0.9
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
#r "nuget: Lyo.KeyStore.Aws, 1.0.9"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
#:package Lyo.KeyStore.Aws@1.0.9
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.
#addin nuget:?package=Lyo.KeyStore.Aws&version=1.0.9
#tool nuget:?package=Lyo.KeyStore.Aws&version=1.0.9
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
Lyo.KeyStore.Aws
AwsKeyStore takes an IAmazonSecretsManager client and a secret-name prefix. It implements Lyo.KeyStore.IKeyStore and Lyo.KeyStore.IKeyInventoryStore, so admin UIs and key-rotation jobs can encrypt against it and list keyIds and versions.
The backing secret is stored as JSON ({ "<keyId>": "plaintext-or-derived-material", ... }) under a single secret per prefix. Logical version strings map onto AWS VersionId stages. Unresolved version requests fall through to AWSCURRENT. String values run through key derivation so callers receive cryptographic-length KEK bytes usable by AesGcmEncryptionService and the other symmetric services in Lyo.Encryption.
AwsKeyStore methods
IKeyStore.GetKey,GetCurrentKey,GetCurrentVersion,AddKey,UpdateKey,HasKey, metadata, salt-for-version. Sync and async variants.IKeyInventoryStore.GetAvailableKeyIdsAsync(CancellationToken),GetAvailableVersionsAsync(string keyId, CancellationToken)so listings, rotation reports, and DEK migrations can pivot off the live store rather than a local index.
AwsKeyStoreOptions
| Property | Default | Notes |
|---|---|---|
SectionName |
AwsKeyStore |
Default appsettings subsection. |
AccessKeyId / SecretAccessKey |
unset | Static credentials. When both are set they win over Profile. Omit to use Profile or the AWS default credential chain (IAM role, env vars, default profile). |
Profile |
unset | Named profile from ~/.aws/credentials / ~/.aws/config. Used when static keys are omitted. If set but missing, registration fails rather than falling back to default. |
Region |
us-east-2 (when unspecified) |
Resolved via RegionEndpoint.GetBySystemName. |
SecretNamePrefix |
lyo/kek fallback |
Logical secret prefix used to scope keys across environments (dev/MyApp/KeyStore, prod/MyApp/KeyStore, …). |
Dependency injection
| Extension | Purpose |
|---|---|
services.AddAwsKeyStore(Func<IServiceProvider,string> resolvePrefix) |
Resolve the prefix from DI (multi-tenant hosts), register AwsKeyStore as a singleton. |
services.AddAwsKeyStoreFromConfiguration(IConfiguration, configSectionName = "AwsKeyStore") |
Bind AwsKeyStoreOptions + register IAmazonSecretsManager (when missing) + register AwsKeyStore and IKeyStore. |
services.AddAmazonSecretsManagerFromConfiguration(IConfiguration, configSectionName = "AwsKeyStore") |
Standalone IAmazonSecretsManager registration (no keystore). Honours static keys, then Profile, then the default credential chain; also honours region. |
services.AddTwoKeyEncryptionServiceKeyed(keyedServiceName, secretNamePrefix) / <TKeyStore> |
Register a keyed ITwoKeyEncryptionService stack using AwsKeyStore plus paired AesGcmEncryptionService for both DEK and KEK. |
services.AddTwoKeyEncryptionServiceKeyed(keyedServiceName, secretNamePrefix, AwsKeyStoreOptions?) |
Same, but with explicit AWS options (region/credentials) rather than configuration binding. |
services.AddTwoKeyEncryptionFromConfiguration(IConfiguration, keyedServiceName, configSectionName) / <TKeyStore> |
Bind AwsKeyStoreOptions from configuration and wire the keyed two-key stack in one call. |
AddAwsKeyStore(Func<...>) registers AwsKeyStore as a concrete singleton only, no IKeyStore indirection. AddAwsKeyStoreFromConfiguration and the two-key extensions also register IKeyStore so Lyo.Encryption can resolve it.
See also
Lyo.KeyStore. Interfaces and local store.Lyo.Encryption. Encryption services that consumeIKeyStore.../README.md. Encryption guide: algorithms, stream formats, threat model.
Dependencies
Generated from ProjectReference / PackageReference (same model as docs/Lyo.ProjectGraph.html).
Lyo.Encryption(direct, lyo)Lyo.KeyStore(direct, lyo)AWSSDK.SecretsManager4.0.100.3(direct, third-party)Microsoft.Extensions.Configuration.Binder10.0.5(direct, microsoft)Microsoft.Extensions.DependencyInjection.Abstractions10.0.5(direct, microsoft)Lyo.Common(transitive, lyo)Lyo.Exceptions(transitive, lyo)Lyo.Hashing(transitive, lyo)Lyo.Result(transitive, lyo)Lyo.Streams(transitive, lyo)BouncyCastle.Cryptography2.6.2(transitive, third-party, netstandard2.0)Konscious.Security.Cryptography.Argon21.3.1(transitive, third-party)Microsoft.Bcl.AsyncInterfaces10.0.5(transitive, microsoft, netstandard2.0)Microsoft.Extensions.Logging.Abstractions10.0.5(transitive, microsoft)System.Buffers4.6.1(transitive, microsoft, netstandard2.0)System.IO.Hashing10.0.5(transitive, microsoft, net10.0)System.Memory4.6.3(transitive, microsoft, netstandard2.0)System.Text.Json10.0.5(transitive, microsoft, netstandard2.0)System.Threading.Tasks.Extensions4.6.3(transitive, microsoft, netstandard2.0)
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.
-
net10.0
- AWSSDK.SecretsManager (>= 4.0.100.3)
- Lyo.Encryption (>= 1.0.9)
- Lyo.KeyStore (>= 1.0.9)
- Microsoft.Extensions.Configuration.Binder (>= 10.0.5)
- Microsoft.Extensions.DependencyInjection.Abstractions (>= 10.0.5)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.