Search by

symfony / aws-key-management

fabpot

Symfony AWS Key Management Bridge

Package info

github.com/symfony/aws-key-management

Homepage

Type:symfony-key-management-bridge

pkg:composer/symfony/aws-key-management

Security

Advisories: 0

Aikido package health analysis

Transparency log

Fund package maintenance!

fabpot

nicolas-grekas

symfony.com/sponsor

Tidelift

Statistics

Installs: 0

Dependents: 0

Suggesters: 0

Stars: 0

8.2.x-dev 2026-09-14 08:33 UTC

Requires

Requires (Dev)

None

Suggests

None

Provides

None

Conflicts

None

Replaces

None

MIT d6f1b8595e705f06c67e4dcd8dc0787ae895af30

  • Jérôme Tamarelle <jerome.woop@tamarelle.net>
  • Florent Morselli <florent.morselli.woop@spomky-labs.com>
  • Symfony Community

amazonencryptionawskms

Published on Packagist.org on 2026-09-14 08:45 UTC

This package is auto-updated.

Last update: 2026-09-14 08:45:47 UTC

README

Provides an implementation of Symfony\Component\KeyManagement\EncrypterInterface and Symfony\Component\KeyManagement\DataKeyGeneratorInterface backed by AWS Key Management Service through the lightweight async-aws/kms client. Encryption, decryption and data-key generation never expose the master key: AWS performs them server-side.

This Bridge is experimental. Experimental features are not covered by Symfony's Backward Compatibility Promise.

use AsyncAws\Core\Configuration;
use AsyncAws\Kms\KmsClient;
use Symfony\Component\KeyManagement\Bridge\AwsKms\AwsKms;

$kms = new AwsKms(new KmsClient(Configuration::create([
    'region' => 'eu-west-1',
    // 'accessKeyId' / 'accessKeySecret' / 'sessionToken' are optional;
    // by default async-aws walks the standard credential provider chain.
])));

// Use the key ARN, key id, or alias (e.g. "alias/app-key").
$ciphertext = $kms->encrypt('alias/app-key', 'hello world');
$plaintext  = $kms->decrypt($ciphertext);

$dataKey = $kms->generateDataKey('alias/app-key', 32);
$result  = $dataKey->use(fn (string $dek): string => /* local AEAD encrypt */);

DSN scheme

aws-kms://[<accessKey>:<secretKey>@]<host>[:<port>]?region=<region>[&session_token=<token>]

The host default selects the public AWS endpoint for the given region; any other host is treated as a custom endpoint (LocalStack, VPC endpoint, ...). Leaving the credentials out lets async-aws fall back to the standard provider chain (env vars, instance profile, ...).

Examples:

aws-kms://default?region=eu-west-1
aws-kms://AKIA...:secret@default?region=us-east-1&session_token=TOKEN
aws-kms://localhost:4566?region=eu-west-1

AAD support

AWS KMS exposes additional authenticated data through EncryptionContext, which is restricted to array<string, string>. To stay compatible with the opaque-bytes contract of EncrypterInterface, this bridge stores the AAD as a single base64-encoded entry under a conventional key. Cross-bridge interoperability is therefore not guaranteed: a ciphertext produced by this bridge with a non-empty AAD only round-trips through the same bridge.

Resources