mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-09 22:59:59 +00:00
overtrue
dbfe3519af
`OperationContext` carried identity and correlation data that nothing ever constructed or read, so key creation, rotation and deletion left no trace of who requested them. Give every management operation a `*_with_context` entry point that builds a `KmsAuditRecord` and hands it to an installed `KmsAuditSink`. The record answers who acted on which key, against which backend, with what outcome and error class, and how long it took. Existing entry points delegate with an explicitly internal principal, so an unattributed call is distinguishable from an identity that was lost. The backend trait is untouched: auditing sits at the layer that has an identity, mirroring how metrics sit at the backend choke point. The sink is optional and no records are built without one, so a deployment that does not consume them is unaffected. Records also cover the background sweep that destroys expired key material, which is otherwise the least observable operation in the crate. Redaction is structural rather than advisory: a record has no field that can hold key material, and caller-supplied encryption context passes through an allowlist that digests everything it does not recognise. Tenant attribution is deliberately left out until tenancy is modelled. Refs rustfs/backlog#1583 (part of rustfs/backlog#1562)
106 lines
3.7 KiB
TOML
106 lines
3.7 KiB
TOML
# Copyright 2024 RustFS Team
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
[package]
|
|
name = "rustfs-kms"
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
rust-version.workspace = true
|
|
version.workspace = true
|
|
homepage.workspace = true
|
|
description = "Key Management Service for RustFS, providing secure key generation, storage, and object encryption capabilities."
|
|
keywords = ["kms", "encryption", "key-management", "rustfs", "security"]
|
|
categories = ["cryptography", "web-programming", "authentication"]
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
hotpath.workspace = true
|
|
# Core dependencies
|
|
async-trait = { workspace = true }
|
|
tokio = { workspace = true, features = ["fs", "io-util", "macros", "rt-multi-thread", "sync", "time"] }
|
|
uuid = { workspace = true, features = ["serde", "v4", "fast-rng", "macro-diagnostics"] }
|
|
jiff = { workspace = true, features = ["serde"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true, features = ["raw_value"] }
|
|
tracing = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
# Operation metrics emitted by the retry policy engine (crate::policy).
|
|
metrics = { workspace = true }
|
|
|
|
# Cryptography
|
|
aes-gcm = { workspace = true, features = ["rand_core"] }
|
|
argon2 = { workspace = true }
|
|
chacha20poly1305 = { workspace = true }
|
|
rand = { workspace = true, features = ["serde"] }
|
|
base64 = { workspace = true }
|
|
hex = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
subtle = { workspace = true }
|
|
zeroize = { workspace = true, features = ["derive"] }
|
|
|
|
# Configuration and storage
|
|
url = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
|
|
# Caching
|
|
moka = { workspace = true, features = ["future"] }
|
|
|
|
# Additional dependencies
|
|
md-5 = { workspace = true }
|
|
arc-swap = { workspace = true }
|
|
rustfs-utils = { workspace = true }
|
|
rustfs-security-governance = { workspace = true }
|
|
# `EventName` for KMS audit records. A leaf crate with no rustfs dependencies,
|
|
# so the audit sink can live outside this crate without a second, drifting
|
|
# copy of the event vocabulary.
|
|
rustfs-s3-types = { workspace = true }
|
|
|
|
# HTTP client for Vault
|
|
reqwest = { workspace = true }
|
|
vaultrs = { workspace = true }
|
|
# vaultrs surfaces transport-level failures as wrapped rustify errors; the
|
|
# operation policy needs the concrete type to classify them for retry decisions.
|
|
rustify = { workspace = true }
|
|
tokio-util = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
anyhow = { workspace = true }
|
|
# Debugging recorder for asserting emitted metrics in tests.
|
|
metrics-util = { version = "0.20", features = ["debugging"] }
|
|
insta = { workspace = true, features = ["yaml", "json"] }
|
|
tempfile = { workspace = true }
|
|
temp-env = { workspace = true }
|
|
# "net" backs the scripted loopback Vault used by the policy wiring tests.
|
|
tokio = { workspace = true, features = ["net", "test-util"] }
|
|
|
|
[features]
|
|
default = []
|
|
hotpath = [
|
|
"hotpath/hotpath",
|
|
"hotpath/tokio",
|
|
"hotpath/reqwest-0-13",
|
|
"rustfs-security-governance/hotpath",
|
|
"rustfs-utils/hotpath",
|
|
]
|
|
hotpath-alloc = [
|
|
"hotpath",
|
|
"hotpath/hotpath-alloc",
|
|
"rustfs-security-governance/hotpath-alloc",
|
|
"rustfs-utils/hotpath-alloc",
|
|
]
|
|
hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu", "rustfs-security-governance/hotpath-cpu", "rustfs-utils/hotpath-cpu"]
|