1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
// Code generated by smithy-go-codegen DO NOT EDIT.
package firehose
import (
"context"
"fmt"
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
"github.com/aws/aws-sdk-go-v2/aws/signer/v4"
"github.com/aws/aws-sdk-go-v2/service/firehose/types"
"github.com/aws/smithy-go/middleware"
smithyhttp "github.com/aws/smithy-go/transport/http"
)
// Enables server-side encryption (SSE) for the delivery stream. This operation is
// asynchronous. It returns immediately. When you invoke it, Kinesis Data Firehose
// first sets the encryption status of the stream to ENABLING , and then to ENABLED
// . The encryption status of a delivery stream is the Status property in
// DeliveryStreamEncryptionConfiguration . If the operation fails, the encryption
// status changes to ENABLING_FAILED . You can continue to read and write data to
// your delivery stream while the encryption status is ENABLING , but the data is
// not encrypted. It can take up to 5 seconds after the encryption status changes
// to ENABLED before all records written to the delivery stream are encrypted. To
// find out whether a record or a batch of records was encrypted, check the
// response elements PutRecordOutput$Encrypted and PutRecordBatchOutput$Encrypted ,
// respectively. To check the encryption status of a delivery stream, use
// DescribeDeliveryStream . Even if encryption is currently enabled for a delivery
// stream, you can still invoke this operation on it to change the ARN of the CMK
// or both its type and ARN. If you invoke this method to change the CMK, and the
// old CMK is of type CUSTOMER_MANAGED_CMK , Kinesis Data Firehose schedules the
// grant it had on the old CMK for retirement. If the new CMK is of type
// CUSTOMER_MANAGED_CMK , Kinesis Data Firehose creates a grant that enables it to
// use the new CMK to encrypt and decrypt data and to manage the grant. For the KMS
// grant creation to be successful, Kinesis Data Firehose APIs
// StartDeliveryStreamEncryption and CreateDeliveryStream should not be called
// with session credentials that are more than 6 hours old. If a delivery stream
// already has encryption enabled and then you invoke this operation to change the
// ARN of the CMK or both its type and ARN and you get ENABLING_FAILED , this only
// means that the attempt to change the CMK failed. In this case, encryption
// remains enabled with the old CMK. If the encryption status of your delivery
// stream is ENABLING_FAILED , you can invoke this operation again with a valid
// CMK. The CMK must be enabled and the key policy mustn't explicitly deny the
// permission for Kinesis Data Firehose to invoke KMS encrypt and decrypt
// operations. You can enable SSE for a delivery stream only if it's a delivery
// stream that uses DirectPut as its source. The StartDeliveryStreamEncryption and
// StopDeliveryStreamEncryption operations have a combined limit of 25 calls per
// delivery stream per 24 hours. For example, you reach the limit if you call
// StartDeliveryStreamEncryption 13 times and StopDeliveryStreamEncryption 12
// times for the same delivery stream in a 24-hour period.
func (c *Client) StartDeliveryStreamEncryption(ctx context.Context, params *StartDeliveryStreamEncryptionInput, optFns ...func(*Options)) (*StartDeliveryStreamEncryptionOutput, error) {
if params == nil {
params = &StartDeliveryStreamEncryptionInput{}
}
result, metadata, err := c.invokeOperation(ctx, "StartDeliveryStreamEncryption", params, optFns, c.addOperationStartDeliveryStreamEncryptionMiddlewares)
if err != nil {
return nil, err
}
out := result.(*StartDeliveryStreamEncryptionOutput)
out.ResultMetadata = metadata
return out, nil
}
type StartDeliveryStreamEncryptionInput struct {
// The name of the delivery stream for which you want to enable server-side
// encryption (SSE).
//
// This member is required.
DeliveryStreamName *string
// Used to specify the type and Amazon Resource Name (ARN) of the KMS key needed
// for Server-Side Encryption (SSE).
DeliveryStreamEncryptionConfigurationInput *types.DeliveryStreamEncryptionConfigurationInput
noSmithyDocumentSerde
}
type StartDeliveryStreamEncryptionOutput struct {
// Metadata pertaining to the operation's result.
ResultMetadata middleware.Metadata
noSmithyDocumentSerde
}
func (c *Client) addOperationStartDeliveryStreamEncryptionMiddlewares(stack *middleware.Stack, options Options) (err error) {
if err := stack.Serialize.Add(&setOperationInputMiddleware{}, middleware.After); err != nil {
return err
}
err = stack.Serialize.Add(&awsAwsjson11_serializeOpStartDeliveryStreamEncryption{}, middleware.After)
if err != nil {
return err
}
err = stack.Deserialize.Add(&awsAwsjson11_deserializeOpStartDeliveryStreamEncryption{}, middleware.After)
if err != nil {
return err
}
if err := addProtocolFinalizerMiddlewares(stack, options, "StartDeliveryStreamEncryption"); err != nil {
return fmt.Errorf("add protocol finalizers: %v", err)
}
if err = addlegacyEndpointContextSetter(stack, options); err != nil {
return err
}
if err = addSetLoggerMiddleware(stack, options); err != nil {
return err
}
if err = awsmiddleware.AddClientRequestIDMiddleware(stack); err != nil {
return err
}
if err = smithyhttp.AddComputeContentLengthMiddleware(stack); err != nil {
return err
}
if err = addResolveEndpointMiddleware(stack, options); err != nil {
return err
}
if err = v4.AddComputePayloadSHA256Middleware(stack); err != nil {
return err
}
if err = addRetryMiddlewares(stack, options); err != nil {
return err
}
if err = awsmiddleware.AddRawResponseToMetadata(stack); err != nil {
return err
}
if err = awsmiddleware.AddRecordResponseTiming(stack); err != nil {
return err
}
if err = addClientUserAgent(stack, options); err != nil {
return err
}
if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil {
return err
}
if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil {
return err
}
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
return err
}
if err = addOpStartDeliveryStreamEncryptionValidationMiddleware(stack); err != nil {
return err
}
if err = stack.Initialize.Add(newServiceMetadataMiddleware_opStartDeliveryStreamEncryption(options.Region), middleware.Before); err != nil {
return err
}
if err = awsmiddleware.AddRecursionDetection(stack); err != nil {
return err
}
if err = addRequestIDRetrieverMiddleware(stack); err != nil {
return err
}
if err = addResponseErrorMiddleware(stack); err != nil {
return err
}
if err = addRequestResponseLogging(stack, options); err != nil {
return err
}
if err = addDisableHTTPSMiddleware(stack, options); err != nil {
return err
}
return nil
}
func newServiceMetadataMiddleware_opStartDeliveryStreamEncryption(region string) *awsmiddleware.RegisterServiceMetadata {
return &awsmiddleware.RegisterServiceMetadata{
Region: region,
ServiceID: ServiceID,
OperationName: "StartDeliveryStreamEncryption",
}
}
|
