I have an AWS Lambda that is used to encrypt PII (Personal Identifying Information) using the AWS Encryption SDK before storing it in DynamoDB.
When retrieving the data from DynamoDB using a different Lambda to display to end users, the average time for each call to KMS is 9.48sec. This is averaged across roughly 2k requests with requests ranging from ~14.5 seconds to ~5.1 seconds. The calls to KMS are being made asynchronously.
The total time from the first KMS call to the last is ~20 seconds
We have considered using data key caching and read this AWS blog post about when to use it.
The input of our data may not be frequent enough to take full advantage of caching, and I am trying to find other ways to improve the performance.
Decrypt Code Sippet:
async function decryptWithKeyring(keyring: KmsKeyringNode, ciphertext: string, context: {}) {
const b: Buffer = Buffer.from(ciphertext, 'base64');
const { plaintext, messageHeader } = await decrypt(keyring, b);
const { encryptionContext } = messageHeader;
Object.entries(context).forEach(([key, value]) => {
if (encryptionContext[key] !== value) {
throw new Error('Encryption Context does not match expected values');
}
});
return plaintext.toString();
}
Encrypt Snippet:
async function encryptWithKeyring(keyring: KmsKeyringNode, value: any, context: any) {
const { result } = await encrypt(keyring, value, { encryptionContext: context });
return result.toString('base64');
}
The conversion to base64 was to facilitate storing in DynamoDB.
