in sdk1/src/main/java/com/amazonaws/services/dynamodbv2/datamodeling/AttributeEncryptor.java [63:95]
public Map<String, AttributeValue> transform(final Parameters<?> parameters) {
// one map of attributeFlags per model class
final ModelClassMetadata metadata = getModelClassMetadata(parameters);
final Map<String, AttributeValue> attributeValues = parameters.getAttributeValues();
// If this class is marked as "DoNotTouch" then we know our encryptor will not change it at all
// so we may as well fast-return and do nothing. This also avoids emitting errors when they
// would not apply.
if (metadata.doNotTouch) {
return attributeValues;
}
// When AttributeEncryptor is used without SaveBehavior.PUT or CLOBBER, it is trying to
// transform only a subset
// of the actual fields stored in DynamoDB. This means that the generated signature will not
// cover any
// unmodified fields. Thus, upon untransform, the signature verification will fail as it won't
// cover all
// expected fields.
if (parameters.isPartialUpdate()) {
throw new DynamoDBMappingException(
"Use of AttributeEncryptor without SaveBehavior.PUT or SaveBehavior.CLOBBER is an error "
+ "and can result in data-corruption. This occured while trying to save "
+ parameters.getModelClass());
}
try {
return encryptor.encryptRecord(
attributeValues, metadata.getEncryptionFlags(), paramsToContext(parameters));
} catch (Exception ex) {
throw new DynamoDBMappingException(ex);
}
}