Encrypt

Source: src/AWS/KMS/Encrypt.ts

Runtime binding for kms:Encrypt.

Bind this operation to a KMS Key (or the alias/... name of a pre-existing key) inside a function runtime to get a callable that automatically injects the KeyId. Payloads are raw Uint8Arrays — the distilled client handles base64 wire encoding transparently.

IAM is scoped to least privilege: the exact key ARN for a Key resource, or the kms:RequestAlias condition for an alias name.

Encrypting Data

Encrypt a Payload

const encrypt = yield* AWS.KMS.Encrypt(key);

const response = yield* encrypt({
  Plaintext: new TextEncoder().encode("attack at dawn"),
});
// response.CiphertextBlob is a Uint8Array

Encrypt with an Encryption Context

const response = yield* encrypt({
  Plaintext: payload,
  EncryptionContext: { tenant: "acme" },
});

Pre-Existing Keys

// Uses a key managed outside this stack; IAM is scoped via kms:RequestAlias.
const encrypt = yield* AWS.KMS.Encrypt("alias/app-key");

Wiring

// Bind in the init phase, call in the handler, and provide the
// EncryptHttp layer on the Function's init Effect (merge the other
// KMS layers with Layer.mergeAll when using several bindings).
export default CryptoFunction.make(
  { main: import.meta.url, url: true },
  Effect.gen(function* () {
    const key = yield* AWS.KMS.Key("AppKey");
    const encrypt = yield* AWS.KMS.Encrypt(key);
    return {
      fetch: Effect.gen(function* () {
        const request = yield* HttpServerRequest;
        const body = yield* request.text;
        const { CiphertextBlob } = yield* encrypt({
          Plaintext: new TextEncoder().encode(body),
        });
        return HttpServerResponse.json({
          ciphertext: Buffer.from(CiphertextBlob!).toString("base64"),
        });
      }),
    };
  }).pipe(Effect.provide(AWS.KMS.EncryptHttp)),
);