Search by

symfony / aws-key-management

fabpot

Symfony AWS Key Management Bridge

Package info

github.com/symfony/aws-key-management

Homepage

Type:symfony-key-management-bridge

pkg:composer/symfony/aws-key-management

Security

Advisories: 0

Aikido package health analysis

Transparency log

Fund package maintenance!

fabpot

nicolas-grekas

symfony.com/sponsor

Tidelift

Statistics

Installs: 3 216

Dependents: 0

Suggesters: 0

Stars: 0

8.2.x-dev 2026-10-13 15:09 UTC

Requires

Requires (Dev)

None

Suggests

None

Provides

None

Conflicts

None

Replaces

None

MIT 10a452bc1234865c515f917d8b75e7ad6e7aab3c

  • Jérôme Tamarelle <jerome.woop@tamarelle.net>
  • Florent Morselli <florent.morselli.woop@spomky-labs.com>
  • Symfony Community

amazonencryptionawskms

Published on Packagist.org on 2026-10-13 15:22 UTC

This package is auto-updated.

Last update: 2026-10-14 16:22:16 UTC

README

Provides an implementation of Symfony\Component\KeyManagement\EncrypterInterface and Symfony\Component\KeyManagement\DataKeyGeneratorInterface backed by AWS Key Management Service through the lightweight async-aws/kms client. Encryption, decryption and data-key generation never expose the master key: AWS performs them server-side.

This Bridge is experimental. Experimental features are not covered by Symfony's Backward Compatibility Promise.

use AsyncAws\Core\Configuration;
use AsyncAws\Kms\KmsClient;
use Symfony\Component\KeyManagement\Bridge\AwsKms\AwsKms;

$kms = new AwsKms(new KmsClient(Configuration::create([
    'region' => 'eu-west-1',
    // 'accessKeyId' / 'accessKeySecret' / 'sessionToken' are optional;
    // by default async-aws walks the standard credential provider chain.
])));

// Use the key ARN, key id, or alias (e.g. "alias/app-key").
$ciphertext = $kms->encrypt('alias/app-key', 'hello world');
$plaintext  = $kms->decrypt($ciphertext);

$dataKey = $kms->generateDataKey('alias/app-key', 32);
$result  = $dataKey->use(fn (string $dek): string => /* local AEAD encrypt */);

Each ciphertext and wrapped data key records the ARN of the key that AWS used, not the alias. Moving an alias to a new key leaves older ciphertexts readable, as long as the previous key stays enabled.

DSN scheme

aws-kms://[<accessKey>:<secretKey>@]<host>[:<port>]?region=<region>[&session_token=<token>&timeout=<seconds>&max_duration=<seconds>]

The host default selects the public AWS endpoint for the given region; any other host is treated as a custom endpoint (LocalStack, VPC endpoint, ...). Leaving the credentials out lets async-aws fall back to the standard provider chain (env vars, instance profile, ...).

The timeout (idle timeout) and max_duration (whole request) options set the HTTP client's timeouts. When the factory is given no client, it builds one with a 5-second timeout and a 10-second max_duration. That client uses the retry strategy of async-aws. A client given to the factory, like the application's http_client, keeps its own timeouts unless the DSN sets them.

Requests don't follow redirects, whatever the client. On a 307 or 308 redirect to another host, the session token and the plaintext would be sent again. When you build the KmsClient yourself, give it a client that doesn't follow redirects.

Examples:

aws-kms://default?region=eu-west-1
aws-kms://AKIA...:secret@default?region=us-east-1&session_token=TOKEN
aws-kms://localhost:4566?region=eu-west-1

AAD support

AWS KMS exposes additional authenticated data through EncryptionContext, which is restricted to array<string, string>. To stay compatible with the opaque-bytes contract of EncrypterInterface, this bridge stores the AAD as a single base64-encoded entry under a conventional key. Cross-bridge interoperability is therefore not guaranteed: a ciphertext produced by this bridge with a non-empty AAD only round-trips through the same bridge.

Resources