AWS SDK for PHP 3.x
  • Namespace
  • Class
Did this page help you? SUBMIT FEEDBACK!

Namespaces

  • Aws
    • AccessAnalyzer
      • Exception
    • Acm
      • Exception
    • ACMPCA
      • Exception
    • AlexaForBusiness
      • Exception
    • Amplify
      • Exception
    • AmplifyBackend
      • Exception
    • Api
      • ErrorParser
      • Parser
        • Exception
      • Serializer
    • ApiGateway
      • Exception
    • ApiGatewayManagementApi
      • Exception
    • ApiGatewayV2
      • Exception
    • AppConfig
      • Exception
    • Appflow
      • Exception
    • AppIntegrationsService
      • Exception
    • ApplicationAutoScaling
      • Exception
    • ApplicationDiscoveryService
      • Exception
    • ApplicationInsights
      • Exception
    • AppMesh
      • Exception
    • AppRegistry
      • Exception
    • Appstream
      • Exception
    • AppSync
      • Exception
    • Arn
      • Exception
    • Athena
      • Exception
    • AuditManager
      • Exception
    • AugmentedAIRuntime
      • Exception
    • AutoScaling
      • Exception
    • AutoScalingPlans
      • Exception
    • Backup
      • Exception
    • Batch
      • Exception
    • Braket
      • Exception
    • Budgets
      • Exception
    • Chime
      • Exception
    • ClientSideMonitoring
      • Exception
    • Cloud9
      • Exception
    • CloudDirectory
      • Exception
    • CloudFormation
      • Exception
    • CloudFront
      • Exception
    • CloudHsm
      • Exception
    • CloudHSMV2
      • Exception
    • CloudSearch
      • Exception
    • CloudSearchDomain
      • Exception
    • CloudTrail
      • Exception
    • CloudWatch
      • Exception
    • CloudWatchEvents
      • Exception
    • CloudWatchLogs
      • Exception
    • CodeArtifact
      • Exception
    • CodeBuild
      • Exception
    • CodeCommit
      • Exception
    • CodeDeploy
      • Exception
    • CodeGuruProfiler
      • Exception
    • CodeGuruReviewer
      • Exception
    • CodePipeline
      • Exception
    • CodeStar
      • Exception
    • CodeStarconnections
      • Exception
    • CodeStarNotifications
      • Exception
    • CognitoIdentity
      • Exception
    • CognitoIdentityProvider
      • Exception
    • CognitoSync
      • Exception
    • Comprehend
      • Exception
    • ComprehendMedical
      • Exception
    • ComputeOptimizer
      • Exception
    • ConfigService
      • Exception
    • Connect
      • Exception
    • ConnectContactLens
      • Exception
    • ConnectParticipant
      • Exception
    • CostandUsageReportService
      • Exception
    • CostExplorer
      • Exception
    • Credentials
    • Crypto
      • Cipher
      • Polyfill
    • CustomerProfiles
      • Exception
    • DatabaseMigrationService
      • Exception
    • DataExchange
      • Exception
    • DataPipeline
      • Exception
    • DataSync
      • Exception
    • DAX
      • Exception
    • Detective
      • Exception
    • DeviceFarm
      • Exception
    • DevOpsGuru
      • Exception
    • DirectConnect
      • Exception
    • DirectoryService
      • Exception
    • DLM
      • Exception
    • DocDB
      • Exception
    • DynamoDb
      • Exception
    • DynamoDbStreams
      • Exception
    • EBS
      • Exception
    • Ec2
      • Exception
    • EC2InstanceConnect
      • Exception
    • Ecr
      • Exception
    • ECRPublic
      • Exception
    • Ecs
      • Exception
    • Efs
      • Exception
    • EKS
      • Exception
    • ElastiCache
      • Exception
    • ElasticBeanstalk
      • Exception
    • ElasticInference
      • Exception
    • ElasticLoadBalancing
      • Exception
    • ElasticLoadBalancingV2
      • Exception
    • ElasticsearchService
      • Exception
    • ElasticTranscoder
      • Exception
    • Emr
      • Exception
    • EMRContainers
      • Exception
    • Endpoint
    • EndpointDiscovery
      • Exception
    • EventBridge
      • Exception
    • Exception
    • Firehose
      • Exception
    • FIS
      • Exception
    • FMS
      • Exception
    • ForecastQueryService
      • Exception
    • ForecastService
      • Exception
    • FraudDetector
      • Exception
    • FSx
      • Exception
    • GameLift
      • Exception
    • Glacier
      • Exception
    • GlobalAccelerator
      • Exception
    • Glue
      • Exception
    • GlueDataBrew
      • Exception
    • Greengrass
      • Exception
    • GreengrassV2
      • Exception
    • GroundStation
      • Exception
    • GuardDuty
      • Exception
    • Handler
      • GuzzleV5
      • GuzzleV6
    • Health
      • Exception
    • HealthLake
      • Exception
    • Honeycode
      • Exception
    • Iam
      • Exception
    • IdentityStore
      • Exception
    • imagebuilder
      • Exception
    • ImportExport
      • Exception
    • Inspector
      • Exception
    • Iot
      • Exception
    • IoT1ClickDevicesService
      • Exception
    • IoT1ClickProjects
      • Exception
    • IoTAnalytics
      • Exception
    • IotDataPlane
      • Exception
    • IoTDeviceAdvisor
      • Exception
    • IoTEvents
      • Exception
    • IoTEventsData
      • Exception
    • IoTFleetHub
      • Exception
    • IoTJobsDataPlane
      • Exception
    • IoTSecureTunneling
      • Exception
    • IoTSiteWise
      • Exception
    • IoTThingsGraph
      • Exception
    • IoTWireless
      • Exception
    • IVS
      • Exception
    • Kafka
      • Exception
    • kendra
      • Exception
    • Kinesis
      • Exception
    • KinesisAnalytics
      • Exception
    • KinesisAnalyticsV2
      • Exception
    • KinesisVideo
      • Exception
    • KinesisVideoArchivedMedia
      • Exception
    • KinesisVideoMedia
      • Exception
    • KinesisVideoSignalingChannels
      • Exception
    • Kms
      • Exception
    • LakeFormation
      • Exception
    • Lambda
      • Exception
    • LexModelBuildingService
      • Exception
    • LexModelsV2
      • Exception
    • LexRuntimeService
      • Exception
    • LexRuntimeV2
      • Exception
    • LicenseManager
      • Exception
    • Lightsail
      • Exception
    • LocationService
      • Exception
    • LookoutEquipment
      • Exception
    • LookoutforVision
      • Exception
    • LookoutMetrics
      • Exception
    • MachineLearning
      • Exception
    • Macie
      • Exception
    • Macie2
      • Exception
    • ManagedBlockchain
      • Exception
    • MarketplaceCatalog
      • Exception
    • MarketplaceCommerceAnalytics
      • Exception
    • MarketplaceEntitlementService
      • Exception
    • MarketplaceMetering
      • Exception
    • MediaConnect
      • Exception
    • MediaConvert
      • Exception
    • MediaLive
      • Exception
    • MediaPackage
      • Exception
    • MediaPackageVod
      • Exception
    • MediaStore
      • Exception
    • MediaStoreData
      • Exception
    • MediaTailor
      • Exception
    • mgn
      • Exception
    • MigrationHub
      • Exception
    • MigrationHubConfig
      • Exception
    • Mobile
      • Exception
    • MQ
      • Exception
    • MTurk
      • Exception
    • Multipart
    • MWAA
      • Exception
    • Neptune
      • Exception
    • NetworkFirewall
      • Exception
    • NetworkManager
      • Exception
    • OpsWorks
      • Exception
    • OpsWorksCM
      • Exception
    • Organizations
      • Exception
    • Outposts
      • Exception
    • Personalize
      • Exception
    • PersonalizeEvents
      • Exception
    • PersonalizeRuntime
      • Exception
    • PI
      • Exception
    • Pinpoint
      • Exception
    • PinpointEmail
      • Exception
    • PinpointSMSVoice
      • Exception
    • Polly
      • Exception
    • Pricing
      • Exception
    • PrometheusService
      • Exception
    • QLDB
      • Exception
    • QLDBSession
      • Exception
    • QuickSight
      • Exception
    • RAM
      • Exception
    • Rds
      • Exception
    • RDSDataService
      • Exception
    • Redshift
      • Exception
    • RedshiftDataAPIService
      • Exception
    • Rekognition
      • Exception
    • ResourceGroups
      • Exception
    • ResourceGroupsTaggingAPI
      • Exception
    • Retry
      • Exception
    • RoboMaker
      • Exception
    • Route53
      • Exception
    • Route53Domains
      • Exception
    • Route53Resolver
      • Exception
    • S3
      • Crypto
      • Exception
      • RegionalEndpoint
        • Exception
      • UseArnRegion
        • Exception
    • S3Control
      • Exception
    • S3Outposts
      • Exception
    • SageMaker
      • Exception
    • SagemakerEdgeManager
      • Exception
    • SageMakerFeatureStoreRuntime
      • Exception
    • SageMakerRuntime
      • Exception
    • SavingsPlans
      • Exception
    • Schemas
      • Exception
    • SecretsManager
      • Exception
    • SecurityHub
      • Exception
    • ServerlessApplicationRepository
      • Exception
    • ServiceCatalog
      • Exception
    • ServiceDiscovery
      • Exception
    • ServiceQuotas
      • Exception
    • Ses
      • Exception
    • SesV2
      • Exception
    • Sfn
      • Exception
    • Shield
      • Exception
    • Signature
    • signer
      • Exception
    • Sms
      • Exception
    • SnowBall
      • Exception
    • Sns
      • Exception
    • Sqs
      • Exception
    • Ssm
      • Exception
    • SSO
      • Exception
    • SSOAdmin
      • Exception
    • SSOOIDC
      • Exception
    • StorageGateway
      • Exception
    • Sts
      • Exception
      • RegionalEndpoints
        • Exception
    • Support
      • Exception
    • Swf
      • Exception
    • Synthetics
      • Exception
    • Textract
      • Exception
    • TimestreamQuery
      • Exception
    • TimestreamWrite
      • Exception
    • TranscribeService
      • Exception
    • Transfer
      • Exception
    • Translate
      • Exception
    • Waf
      • Exception
    • WafRegional
      • Exception
    • WAFV2
      • Exception
    • WellArchitected
      • Exception
    • WorkDocs
      • Exception
    • WorkLink
      • Exception
    • WorkMail
      • Exception
    • WorkMailMessageFlow
      • Exception
    • WorkSpaces
      • Exception
    • XRay
      • Exception
  • GuzzleHttp
    • Promise
    • Psr7
  • Psr
    • Http
      • Message

Classes

  • HeadersMetadataStrategy
  • InstructionFileMetadataStrategy
  • S3EncryptionClient
  • S3EncryptionClientV2
  • S3EncryptionMultipartUploader
  • S3EncryptionMultipartUploaderV2

Traits

  • CryptoParamsTrait
  • CryptoParamsTraitV2
  • UserAgentTrait

Class S3EncryptionClientV2

Aws\Crypto\AbstractCryptoClientV2
Extended by Aws\S3\Crypto\S3EncryptionClientV2 uses Aws\Crypto\Cipher\CipherBuilderTrait, Aws\S3\Crypto\CryptoParamsTraitV2, Aws\Crypto\DecryptionTraitV2, Aws\Crypto\EncryptionTraitV2, Aws\S3\Crypto\UserAgentTrait
Namespace: Aws\S3\Crypto
Located at S3/Crypto/S3EncryptionClientV2.php

Provides a wrapper for an S3Client that supplies functionality to encrypt data on putObject[Async] calls and decrypt data on getObject[Async] calls.

AWS strongly recommends the upgrade to the S3EncryptionClientV2 (over the S3EncryptionClient), as it offers updated data security best practices to our customers who upgrade. S3EncryptionClientV2 contains breaking changes, so this will require planning by engineering teams to migrate. New workflows should just start with S3EncryptionClientV2.

Note that for PHP versions of < 7.1, this class uses an AES-GCM polyfill for encryption since there is no native PHP support. The performance for large inputs will be a lot slower than for PHP 7.1+, so upgrading older PHP version environments may be necessary to use this effectively.

Example write path:

use Aws\Crypto\KmsMaterialsProviderV2;
use Aws\S3\Crypto\S3EncryptionClientV2;
use Aws\S3\S3Client;

$encryptionClient = new S3EncryptionClientV2(
    new S3Client([
        'region' => 'us-west-2',
        'version' => 'latest'
    ])
);
$materialsProvider = new KmsMaterialsProviderV2(
    new KmsClient([
        'profile' => 'default',
        'region' => 'us-east-1',
        'version' => 'latest',
    ],
   'your-kms-key-id'
);

$encryptionClient->putObject([
    '@MaterialsProvider' => $materialsProvider,
    '@CipherOptions' => [
        'Cipher' => 'gcm',
        'KeySize' => 256,
    ],
    '@KmsEncryptionContext' => ['foo' => 'bar'],
    'Bucket' => 'your-bucket',
    'Key' => 'your-key',
    'Body' => 'your-encrypted-data',
]);

Example read call (using objects from previous example):

$encryptionClient->getObject([
    '@MaterialsProvider' => $materialsProvider,
    '@CipherOptions' => [
        'Cipher' => 'gcm',
        'KeySize' => 256,
    ],
    'Bucket' => 'your-bucket',
    'Key' => 'your-key',
]);

Methods Summary

  • __construct ( Aws\S3\S3Client $client, string|null $instructionFileSuffix = null )
  • putObjectAsync ( array $args )

    Encrypts the data in the 'Body' field of $args and promises to upload it to the specified location on S3.

  • putObject ( array $args )

    Encrypts the data in the 'Body' field of $args and uploads it to the specified location on S3.

  • getObjectAsync ( array $args )

    Promises to retrieve an object from S3 and decrypt the data in the 'Body' field.

  • getObject ( array $args )

    Retrieves an object from S3 and decrypts the data in the 'Body' field.

Methods inherited from Aws\Crypto\AbstractCryptoClientV2

decrypt(), encrypt(), isSupportedCipher()

Methods Details

__construct ( Aws\S3\S3Client $client, string|null $instructionFileSuffix = null )

Parameters

Aws\S3\S3Client $client

The S3Client to be used for true uploading and retrieving objects from S3 when using the encryption client.

string|null $instructionFileSuffix = null

Suffix for a client wide default when using instruction files for metadata storage.

GuzzleHttp\Promise\PromiseInterface putObjectAsync ( array $args )

Encrypts the data in the 'Body' field of $args and promises to upload it to the specified location on S3.

Note that for PHP versions of < 7.1, this operation uses an AES-GCM polyfill for encryption since there is no native PHP support. The performance for large inputs will be a lot slower than for PHP 7.1+, so upgrading older PHP version environments may be necessary to use this effectively.

Parameters

array $args

Arguments for encrypting an object and uploading it to S3 via PutObject.

The required configuration arguments are as follows:

  • @MaterialsProvider: (MaterialsProviderV2) Provides Cek, Iv, and Cek encrypting/decrypting for encryption metadata.
  • @CipherOptions: (array) Cipher options for encrypting data. Only the Cipher option is required. Accepts the following:
    • Cipher: (string) gcm See also: AbstractCryptoClientV2::$supportedCiphers
    • KeySize: (int) 128|256 See also: MaterialsProvider::$supportedKeySizes
    • Aad: (string) Additional authentication data. This option is passed directly to OpenSSL when using gcm. Note if you pass in Aad, the PHP SDK will be able to decrypt the resulting object, but other AWS SDKs may not be able to do so.
  • @KmsEncryptionContext: (array) Only required if using KmsMaterialsProviderV2. An associative array of key-value pairs to be added to the encryption context for KMS key encryption. An empty array may be passed if no additional context is desired.

The optional configuration arguments are as follows:

  • @MetadataStrategy: (MetadataStrategy|string|null) Strategy for storing MetadataEnvelope information. Defaults to using a HeadersMetadataStrategy. Can either be a class implementing MetadataStrategy, a class name of a predefined strategy, or empty/null to default.
  • @InstructionFileSuffix: (string|null) Suffix used when writing to an instruction file if using an InstructionFileMetadataHandler.

Returns

GuzzleHttp\Promise\PromiseInterface

Exceptions

InvalidArgumentException

Thrown when arguments above are not passed or are passed incorrectly.

Aws\Result putObject ( array $args )

Encrypts the data in the 'Body' field of $args and uploads it to the specified location on S3.

Note that for PHP versions of < 7.1, this operation uses an AES-GCM polyfill for encryption since there is no native PHP support. The performance for large inputs will be a lot slower than for PHP 7.1+, so upgrading older PHP version environments may be necessary to use this effectively.

Parameters

array $args

Arguments for encrypting an object and uploading it to S3 via PutObject.

The required configuration arguments are as follows:

  • @MaterialsProvider: (MaterialsProvider) Provides Cek, Iv, and Cek encrypting/decrypting for encryption metadata.
  • @CipherOptions: (array) Cipher options for encrypting data. A Cipher is required. Accepts the following options:
    • Cipher: (string) gcm See also: AbstractCryptoClientV2::$supportedCiphers
    • KeySize: (int) 128|256 See also: MaterialsProvider::$supportedKeySizes
    • Aad: (string) Additional authentication data. This option is passed directly to OpenSSL when using gcm. Note if you pass in Aad, the PHP SDK will be able to decrypt the resulting object, but other AWS SDKs may not be able to do so.
  • @KmsEncryptionContext: (array) Only required if using KmsMaterialsProviderV2. An associative array of key-value pairs to be added to the encryption context for KMS key encryption. An empty array may be passed if no additional context is desired.

The optional configuration arguments are as follows:

  • @MetadataStrategy: (MetadataStrategy|string|null) Strategy for storing MetadataEnvelope information. Defaults to using a HeadersMetadataStrategy. Can either be a class implementing MetadataStrategy, a class name of a predefined strategy, or empty/null to default.
  • @InstructionFileSuffix: (string|null) Suffix used when writing to an instruction file if an using an InstructionFileMetadataHandler was determined.

Returns

Aws\Result

PutObject call result with the details of uploading the encrypted file.

Exceptions

InvalidArgumentException

Thrown when arguments above are not passed or are passed incorrectly.

GuzzleHttp\Promise\PromiseInterface getObjectAsync ( array $args )

Promises to retrieve an object from S3 and decrypt the data in the 'Body' field.

Parameters

array $args

Arguments for retrieving an object from S3 via GetObject and decrypting it.

The required configuration argument is as follows:

  • @MaterialsProvider: (MaterialsProviderInterface) Provides Cek, Iv, and Cek encrypting/decrypting for decryption metadata. May have data loaded from the MetadataEnvelope upon decryption.
  • @SecurityProfile: (string) Must be set to 'V2' or 'V2_AND_LEGACY'.
    • 'V2' indicates that only objects encrypted with S3EncryptionClientV2 content encryption and key wrap schemas are able to be decrypted.
    • 'V2_AND_LEGACY' indicates that objects encrypted with both S3EncryptionClientV2 and older legacy encryption clients are able to be decrypted.

The optional configuration arguments are as follows:

  • SaveAs: (string) The path to a file on disk to save the decrypted object data. This will be handled by file_put_contents instead of the Guzzle sink.

  • @MetadataStrategy: (MetadataStrategy|string|null) Strategy for reading MetadataEnvelope information. Defaults to determining based on object response headers. Can either be a class implementing MetadataStrategy, a class name of a predefined strategy, or empty/null to default.

  • @InstructionFileSuffix: (string) Suffix used when looking for an instruction file if an InstructionFileMetadataHandler is being used.
  • @CipherOptions: (array) Cipher options for decrypting data. A Cipher is required. Accepts the following options:
    • Aad: (string) Additional authentication data. This option is passed directly to OpenSSL when using gcm. It is ignored when using cbc.
  • @KmsAllowDecryptWithAnyCmk: (bool) This allows decryption with KMS materials for any KMS key ID, instead of needing the KMS key ID to be specified and provided to the decrypt operation. Ignored for non-KMS materials providers. Defaults to false.

Returns

GuzzleHttp\Promise\PromiseInterface

Exceptions

InvalidArgumentException

Thrown when required arguments are not passed or are passed incorrectly.

Aws\Result getObject ( array $args )

Retrieves an object from S3 and decrypts the data in the 'Body' field.

Parameters

array $args

Arguments for retrieving an object from S3 via GetObject and decrypting it.

The required configuration argument is as follows:

  • @MaterialsProvider: (MaterialsProviderInterface) Provides Cek, Iv, and Cek encrypting/decrypting for decryption metadata. May have data loaded from the MetadataEnvelope upon decryption.
  • @SecurityProfile: (string) Must be set to 'V2' or 'V2_AND_LEGACY'.
    • 'V2' indicates that only objects encrypted with S3EncryptionClientV2 content encryption and key wrap schemas are able to be decrypted.
    • 'V2_AND_LEGACY' indicates that objects encrypted with both S3EncryptionClientV2 and older legacy encryption clients are able to be decrypted.

The optional configuration arguments are as follows:

  • SaveAs: (string) The path to a file on disk to save the decrypted object data. This will be handled by file_put_contents instead of the Guzzle sink.
  • @InstructionFileSuffix: (string|null) Suffix used when looking for an instruction file if an InstructionFileMetadataHandler was detected.
  • @CipherOptions: (array) Cipher options for encrypting data. A Cipher is required. Accepts the following options:
    • Aad: (string) Additional authentication data. This option is passed directly to OpenSSL when using gcm. It is ignored when using cbc.
  • @KmsAllowDecryptWithAnyCmk: (bool) This allows decryption with KMS materials for any KMS key ID, instead of needing the KMS key ID to be specified and provided to the decrypt operation. Ignored for non-KMS materials providers. Defaults to false.

Returns

Aws\Result

GetObject call result with the 'Body' field wrapped in a decryption stream with its metadata information.

Exceptions

InvalidArgumentException

Thrown when arguments above are not passed or are passed incorrectly.

Constants summary

string CRYPTO_VERSION
# '2.1'
AWS SDK for PHP 3.x API documentation generated by ApiGen