in DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedClientEncryption.java [444:515]
private static void scanForIgnoredEncryptionTags(
final TableSchema<?> tableSchema,
final String attributeName,
final StringBuilder path
) {
AttributeConverter<?> attributeConverter =
tableSchema.converterForAttribute(attributeName);
StringBuilder attributePath = new StringBuilder(path)
.append(attributeName)
.append(".");
if (
Objects.nonNull(attributeConverter) &&
Objects.nonNull(attributeConverter.type()) &&
attributeConverter.type().tableSchema().isPresent()
) {
TableSchema<?> subTableSchema = attributeConverter
.type()
.tableSchema()
.get();
Set<String> signOnlyAttributes = getSignOnlyAttributes(subTableSchema);
if (signOnlyAttributes.size() > 0) {
throw DynamoDbEncryptionException
.builder()
.message(
String.format(
"Detected DynamoDbEncryption Tag %s on a nested attribute with Path %s. " +
"This is NOT Supported at this time!",
CUSTOM_DDB_ENCRYPTION_SIGN_ONLY_PREFIX,
attributePath.append(signOnlyAttributes.toArray()[0])
)
)
.build();
}
Set<String> signAndIncludeAttributes =
getSignAndIncludeInEncryptionContextAttributes(subTableSchema);
if (signAndIncludeAttributes.size() > 0) {
throw DynamoDbEncryptionException
.builder()
.message(
String.format(
"Detected DynamoDbEncryption Tag %s on a nested attribute with Path %s. " +
"This is NOT Supported at this time!",
CUSTOM_DDB_ENCRYPTION_SIGN_AND_INCLUDE_PREFIX,
attributePath.append(signAndIncludeAttributes.toArray()[0])
)
)
.build();
}
Set<String> doNothingAttributes = getDoNothingAttributes(subTableSchema);
if (doNothingAttributes.size() > 0) {
throw DynamoDbEncryptionException
.builder()
.message(
String.format(
"Detected DynamoDbEncryption Tag %s on a nested attribute with Path %s. " +
"This is NOT Supported at this time!",
CUSTOM_DDB_ENCRYPTION_DO_NOTHING_PREFIX,
attributePath.append(doNothingAttributes.toArray()[0])
)
)
.build();
}
List<String> subAttributeNames = subTableSchema.attributeNames();
for (String subAttributeName : subAttributeNames) {
scanForIgnoredEncryptionTags(
subTableSchema,
subAttributeName,
attributePath
);
}
}
}