AWS XPath Functions

The Amazon Common Services plug-in includes a set of XPath functions that help encrypt and decrypt data using AWS Key Management Service (KMS). You can use different authentication mechanisms to connect with KMS using XPath functions such as default credentials provider, cross-account access, or Amazon Shared Resource. For details on how to use the XPath functions, refer to the functions at design time.

AWS Functions Description
encrypt Encrypt data by using KMS custom keys with default credentials
encrypt-with-crossaccount Encrypt data by using KMS custom keys with default credentials and cross-account
encrypt-with-sharedresource Encrypt data by using KMS custom keys and shared resource
decrypt Decrypt data by using KMS custom keys with default credentials
decrypt-with-crossaccount Decrypt data by using KMS custom keys with default credentials and cross account
decrypt-with-sharedresource Decrypt data by using KMS custom keys and shared resource

Considerations for XPath Functions:

  • encrypt, encrypt-with-crossaccount, decrypt, decrypt-with-crossaccount need default profile when using default credentials.
  • encrypt-with-sharedresource and decrypt-with-sharedresource do not work with shared resource when using external temporary credentials.