Decrypt: Decrypt records in a topic with both encrypted and unencrypted records - Policy

Decrypt records in a topic with both encrypted and unencrypted records

Use a condition to decrypt only records that the Encrypt policy encrypted.

If a topic contains both encrypted and unencrypted records, the Decrypt policy fails on unencrypted records because it can’t find a key reference in the kong/enc header.

For example, this happens when you enable the Encrypt policy after the topic already contains records. To prevent this, add a condition that runs the policy only on records that carry the kong/enc header. The Encrypt policy adds this header to every record that it encrypts.

Prerequisites

A topic that contains both encrypted and unencrypted records.
A static key.

Set up the policy

curl -X POST https://{region}.api.konghq.com/v1/event-gateways/{eventGatewayId}/virtual-clusters/{virtualClusterId}/consume-policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "decrypt-encrypted-records-only",
      "type": "decrypt",
      "condition": "'kong/enc' in record.headers",
      "config": {
        "failure_mode": "error",
        "part_of_record": [
          "value"
        ],
        "key_sources": [
          {
            "type": "static"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
virtualClusterId: The id of the Virtual Cluster.
eventGatewayId: The id of the Event Gateway.
eventGatewayListenerId: The id of the Event Gateway Listener.

See the Konnect Event Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect-beta = {
      source  = "kong/konnect-beta"
    }
  }
}

provider "konnect-beta" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_event_gateway_consume_policy_decrypt" "my_virtual_cluster_policy_decrypt" {
  provider = konnect-beta
  type = "decrypt"
  condition = "'kong/enc' in record.headers"
  config = {
    failure_mode = "error"
    part_of_record = ["value"]
    key_sources = [
      {
        type = "static"
      }    ]
  }


  virtual_cluster_id = konnect_event_gateway_virtual_cluster.my_virtual_cluster.id

  gateway_id = konnect_event_gateway.my_event_gateway.id
}

Copied!

The following example creates a new decrypt policy.

kongctl

event_gateway_policy.yaml

Copied!

event_gateways:
  - ref: eventGatewayName
    name: eventGatewayName
    virtual_clusters:
    - ref: virtualClusterName
      name: virtualClusterName
      consume_policies:
      - ref: decrypt-encrypted-records-only
        type: decrypt
        decrypt:
          name: decrypt-encrypted-records-only
          condition: "'kong/enc' in record.headers"
          config:
            failure_mode: error
            part_of_record:
            - value
            key_sources:
            - type: static

Make sure to replace the following placeholders with your own values:

eventGatewayName: The name of your Event Gateway.
virtualClusterName: The name of the Virtual Cluster.

Decrypt

Decrypt records in a topic with both encrypted and unencrypted records

Prerequisites

Set up the policy

Help us make these docs great!

Still need help?