The Encrypt Fields policy is used to encrypt fields of Kafka messages that have been validated to conform to a schema.
This policy uses AES-256-GCM for encryption, therefore keys must be 256 bits long.
Use the Encrypt Fields policy together with the Decrypt Fields policy, which decrypts fields of a message using the same referenced key, to enforce standards for encryption across Kong Event Gateway clients.
Common use cases for the Encrypt Fields policy:
|
Use case |
Description |
|---|---|
| Encrypt a message field using a static key | Encrypt a message field using a static key. |
| Encrypt a message field using an AWS key source | Encrypt a message field using an AWS key source. |
| Encrypt a message field using a dynamic list of field paths | Encrypt a message field using a dynamic list of field paths |
| Tutorial: Encrypt fields selected by schema registry tags |
Encrypt the fields that carry a PII tag in a Confluent Schema Registry, so that encryption follows schema evolution without policy changes.
|
This policy runs during the produce phase, after schema validation has taken place.
Note: This policy only runs on records that the parent Schema Validation policy successfully parses. If the parent policy uses the
passthroughormarkfailure mode, records that fail schema validation are sent to the backend cluster without parsing, so this policy can’t run on them and their fields are left unchanged.
sequenceDiagram autonumber participant client as Client participant egw as Event Gateway participant broker as Event broker client->>egw: produce message egw->>egw: encrypt message egw->>broker: send encrypted message broker->>egw: consume message egw->>egw: decrypt message egw->>client: send message
The Encrypt Fields policy appends a kong/enc header to each message. This header identifies the encryption key by its ID, for example when using a static key.
Only the fields matched by the policy are encrypted, while the rest of the value structure is left intact. In the following message, the personal.ssn field is encrypted, but the sibling personal.name field is left in plaintext:
{
"Partition": 0,
"Offset": 0,
"Headers": {
"kong/enc": "\u0000\u0004\u0000-static://019a537d-96ca-74f7-8903-aa99905e722d"
},
"Value": "{\"personal\":{\"name\":\"Jane Doe\",\"ssn\":\"AHry69Jl4oJzafOlu/xOjVa37hpfYTAVXoAolj94NoBQSKz7dkEF/gg=\"}}"
}When decrypting, the Decrypt Fields policy reads the key reference from the kong/enc header. It then retrieves the corresponding key from the configured key sources and uses it to decrypt only the matched fields.
You must define a key for the Encrypt Fields policy. This policy supports the following key sources:
aws): An AWS key vault.static): An array of explicitly defined static keys.If paths is set to an expression that reads record.value.schema.metadata.tags or record.value.schema.metadata.properties, the schema registry becomes a trusted input to this policy. Anyone with write access to the registry can change which fields get encrypted by editing a schema’s tags or properties, without touching this policy’s configuration at all.