confium_store_cloud/lib.rs
1//! Confium Store cloud KMS backends.
2//!
3//! This crate implements [`confium_store::backend::StoreBackend`] for the
4//! three major cloud key management services:
5//!
6//! - **AWS Key Management Service** (feature `aws-kms`)
7//! - **Google Cloud Key Management Service** (feature `gcp-kms`)
8//! - **Azure Key Vault** (feature `azure-keyvault`)
9//!
10//! Each backend lives behind its own Cargo feature so consumers can pull
11//! in only the SDK they need. With no features enabled the crate compiles
12//! to nothing — it exists purely to host the three backends. See
13//! `TODO.roadmap/18-hardware-keystore-backends.md` for the design.
14//!
15//! # Wire names
16//!
17//! Backends register under the wire names `"aws-kms"`, `"gcp-kms"` and
18//! `"azure-keyvault"`. Pass these to `cfm_keystore_create` (or to
19//! [`confium_store::Keystore::new`]) once this crate is linked into the
20//! process; the link-time inventory takes care of registration.
21//!
22//! # KMS API status
23//!
24//! Client construction is real for all three providers (credentials,
25//! region/endpoint/project/vault resolution; lazy on first use).
26//! `aws-kms` additionally lists real KMS key IDs via `ListKeys` in
27//! `enumerate` (remote keys carry no local handle — the index string
28//! is the KMS key ID). Secret/public put/get remain
29//! [`confium_store::error::Error::NotImplemented`] pending the
30//! `cfmp_sign_with_handle` plugin contract from TODO #03 — cloud KMS
31//! providers never export private key material, so remote sign is the
32//! only path for KMS-held keys.
33
34pub mod backends;
35
36// Re-export the active backend factory types so consumers can construct
37// them directly without depending on the per-feature module path. Each
38// alias is only present when its feature is enabled, mirroring how the
39// backends are conditionally compiled.
40#[cfg(feature = "aws-kms")]
41pub use backends::aws_kms::AwsKmsBackend;
42#[cfg(feature = "azure-keyvault")]
43pub use backends::azure_keyvault::AzureKeyVaultBackend;
44#[cfg(feature = "gcp-kms")]
45pub use backends::gcp_kms::GcpKmsBackend;