From 12788bffb575559da4dc3957db713e4f14364b99 Mon Sep 17 00:00:00 2001 From: Michael Stetsyuk Date: Thu, 10 Sep 2026 15:28:50 +0000 Subject: [PATCH] Allocate AWSCredentials secret key and signing key through a dedicated memory system Adds MemoryManagementOptions::sensitiveMemoryManager, Aws::SensitiveAllocator and Aws::SensitiveString, honoured regardless of USE_AWS_MEMORY_MANAGEMENT. The secret access key inside Aws::Auth::AWSCredentials and the SigV4 signing key are stored in Aws::SensitiveString, so an application can keep them out of core dumps. Co-Authored-By: Claude Fable 5.1 --- src/aws-cpp-sdk-core/include/aws/core/Aws.h | 7 +++ .../include/aws/core/auth/AWSCredentials.h | 17 ++++--- .../auth/signer/AWSAuthEventStreamV4Signer.h | 4 +- .../aws/core/auth/signer/AWSAuthV4Signer.h | 4 +- .../include/aws/core/utils/HashingUtils.h | 2 + .../include/aws/core/utils/memory/AWSMemory.h | 15 ++++++ .../aws/core/utils/memory/stl/AWSAllocator.h | 50 +++++++++++++++++++ .../aws/core/utils/memory/stl/AWSString.h | 2 + .../AwsCredentialsProviderIdentityResolver.h | 2 +- .../DefaultAwsCredentialIdentityResolver.h | 3 +- .../SimpleAwsCredentialIdentityResolver.h | 2 +- src/aws-cpp-sdk-core/source/Aws.cpp | 8 +++ .../signer/AWSAuthEventStreamV4Signer.cpp | 7 ++- .../source/auth/signer/AWSAuthV4Signer.cpp | 4 +- .../source/utils/HashingUtils.cpp | 18 +++++++ .../source/utils/memory/AWSMemory.cpp | 26 ++++++++++ 16 files changed, 152 insertions(+), 19 deletions(-) diff --git a/src/aws-cpp-sdk-core/include/aws/core/Aws.h b/src/aws-cpp-sdk-core/include/aws/core/Aws.h index dc68dde4600b..b1cf13a5199d 100644 --- a/src/aws-cpp-sdk-core/include/aws/core/Aws.h +++ b/src/aws-cpp-sdk-core/include/aws/core/Aws.h @@ -61,6 +61,13 @@ struct MemoryManagementOptions { * at startup time. */ Aws::Utils::Memory::MemorySystemInterface* memoryManager = nullptr; + + /** + * Defaults to nullptr. If this has been set then it will be installed at startup time and used for sensitive data + * such as secret keys, regardless of whether custom memory management has been turned on. If this hasn't been set, + * sensitive data is allocated like any other data. + */ + Aws::Utils::Memory::MemorySystemInterface* sensitiveMemoryManager = nullptr; }; /** diff --git a/src/aws-cpp-sdk-core/include/aws/core/auth/AWSCredentials.h b/src/aws-cpp-sdk-core/include/aws/core/auth/AWSCredentials.h index 600a60bd56a9..1dd800a56591 100644 --- a/src/aws-cpp-sdk-core/include/aws/core/auth/AWSCredentials.h +++ b/src/aws-cpp-sdk-core/include/aws/core/auth/AWSCredentials.h @@ -63,7 +63,7 @@ namespace Aws * Expiration date is set to "never expire". */ AWSCredentials(const Aws::String& accessKeyId, const Aws::String& secretKey) : - m_accessKeyId(accessKeyId), m_secretKey(secretKey), m_expiration((std::chrono::time_point::max)()) + m_accessKeyId(accessKeyId), m_secretKey(secretKey.data(), secretKey.size()), m_expiration((std::chrono::time_point::max)()) { } @@ -72,6 +72,11 @@ namespace Aws * Expiration date is set to "never expire". */ AWSCredentials(const Aws::String& accessKeyId, const Aws::String& secretKey, const Aws::String& sessionToken) : + m_accessKeyId(accessKeyId), m_secretKey(secretKey.data(), secretKey.size()), m_sessionToken(sessionToken), m_expiration((std::chrono::time_point::max)()) + { + } + + AWSCredentials(const Aws::String& accessKeyId, const Aws::SensitiveString& secretKey, const Aws::String& sessionToken) : m_accessKeyId(accessKeyId), m_secretKey(secretKey), m_sessionToken(sessionToken), m_expiration((std::chrono::time_point::max)()) { } @@ -80,7 +85,7 @@ namespace Aws * Initializes object with accessKeyId, secretKey, sessionToken and expiration date. */ AWSCredentials(const Aws::String& accessKeyId, const Aws::String& secretKey, const Aws::String& sessionToken, Aws::Utils::DateTime expiration) : - m_accessKeyId(accessKeyId), m_secretKey(secretKey), m_sessionToken(sessionToken), m_expiration(expiration) + m_accessKeyId(accessKeyId), m_secretKey(secretKey.data(), secretKey.size()), m_sessionToken(sessionToken), m_expiration(expiration) { } @@ -93,7 +98,7 @@ namespace Aws Aws::Utils::DateTime expiration, const Aws::String& accountId) : m_accessKeyId(accessKeyId), - m_secretKey(secretKey), + m_secretKey(secretKey.data(), secretKey.size()), m_sessionToken(sessionToken), m_expiration(expiration), m_accountId(accountId) {} @@ -142,7 +147,7 @@ namespace Aws /** * Gets the underlying secret key credential */ - inline const Aws::String& GetAWSSecretKey() const + inline const Aws::SensitiveString& GetAWSSecretKey() const { return m_secretKey; } @@ -184,7 +189,7 @@ namespace Aws */ inline void SetAWSSecretKey(const Aws::String& secretKey) { - m_secretKey = secretKey; + m_secretKey.assign(secretKey.data(), secretKey.size()); } /** @@ -257,7 +262,7 @@ namespace Aws inline void AddUserAgentFeature(Aws::Client::UserAgentFeature feature) { m_context.AddUserAgentFeature(feature); } private: Aws::String m_accessKeyId; - Aws::String m_secretKey; + Aws::SensitiveString m_secretKey; Aws::String m_sessionToken; Aws::Utils::DateTime m_expiration; Aws::String m_accountId; diff --git a/src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthEventStreamV4Signer.h b/src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthEventStreamV4Signer.h index e82a56a973e7..a736f6d2bae7 100644 --- a/src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthEventStreamV4Signer.h +++ b/src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthEventStreamV4Signer.h @@ -100,14 +100,14 @@ namespace Aws const Aws::String& canonicalRequestHash, const Aws::String& region, const Aws::String& serviceName) const; Aws::Utils::ByteBuffer ComputeHash(const Aws::String& secretKey, const Aws::String& simpleDate) const; - Aws::Utils::ByteBuffer ComputeHash(const Aws::String& secretKey, + Aws::Utils::ByteBuffer ComputeHash(const Aws::SensitiveString& secretKey, const Aws::String& simpleDate, const Aws::String& region, const Aws::String& serviceName) const; const Aws::String m_serviceName; const Aws::String m_region; mutable Utils::Threading::ReaderWriterLock m_derivedKeyLock; mutable Aws::Utils::ByteBuffer m_derivedKey; mutable Aws::String m_currentDateStr; - mutable Aws::String m_currentSecretKey; + mutable Aws::SensitiveString m_currentSecretKey; Aws::Vector m_unsignedHeaders; std::shared_ptr m_credentialsProvider; }; diff --git a/src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthV4Signer.h b/src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthV4Signer.h index e10b660e4115..dc315a020837 100644 --- a/src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthV4Signer.h +++ b/src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthV4Signer.h @@ -205,7 +205,7 @@ namespace Aws Aws::String GenerateStringToSign(const Aws::String& dateValue, const Aws::String& simpleDate, const Aws::String& canonicalRequestHash, const Aws::String& region, const Aws::String& serviceName) const; - Aws::Utils::ByteBuffer ComputeHash(const Aws::String& secretKey, + Aws::Utils::ByteBuffer ComputeHash(const Aws::SensitiveString& secretKey, const Aws::String& simpleDate, const Aws::String& region, const Aws::String& serviceName) const; bool SignRequestWithSigV4a(Aws::Http::HttpRequest& request, const char* region, const char* serviceName, bool signBody, long long expirationTimeInSeconds, Aws::Crt::Auth::SignatureType signatureType) const; @@ -230,7 +230,7 @@ namespace Aws //interface can remain const. mutable Aws::Utils::ByteBuffer m_partialSignature; mutable Aws::String m_currentDateStr; - mutable Aws::String m_currentSecretKey; + mutable Aws::SensitiveString m_currentSecretKey; mutable Utils::Threading::ReaderWriterLock m_partialSignatureLock; PayloadSigningPolicy m_payloadSigningPolicy; bool m_urlEscapePath; diff --git a/src/aws-cpp-sdk-core/include/aws/core/utils/HashingUtils.h b/src/aws-cpp-sdk-core/include/aws/core/utils/HashingUtils.h index 25804d5c8c05..b6c20944e993 100644 --- a/src/aws-cpp-sdk-core/include/aws/core/utils/HashingUtils.h +++ b/src/aws-cpp-sdk-core/include/aws/core/utils/HashingUtils.h @@ -47,6 +47,8 @@ namespace Aws */ static ByteBuffer CalculateSHA256HMAC(const ByteBuffer& toSign, const ByteBuffer& secret); + static ByteBuffer CalculateSHA256HMAC(const Aws::String& toSign, const Aws::SensitiveString& secret); + /** * Calculates a SHA512 Hash digest (not hex encoded) */ diff --git a/src/aws-cpp-sdk-core/include/aws/core/utils/memory/AWSMemory.h b/src/aws-cpp-sdk-core/include/aws/core/utils/memory/AWSMemory.h index 16960f0a4659..a918eb8a7b4d 100644 --- a/src/aws-cpp-sdk-core/include/aws/core/utils/memory/AWSMemory.h +++ b/src/aws-cpp-sdk-core/include/aws/core/utils/memory/AWSMemory.h @@ -38,6 +38,21 @@ namespace Aws */ AWS_CORE_API MemorySystemInterface* GetMemorySystem(); + /** + * Installs the memory system used for sensitive data such as secret keys, regardless of USE_AWS_MEMORY_MANAGEMENT + */ + AWS_CORE_API void InitializeAWSSensitiveMemorySystem(MemorySystemInterface& memorySystem); + + /** + * Uninstalls the memory system used for sensitive data + */ + AWS_CORE_API void ShutdownAWSSensitiveMemorySystem(void); + + /** + * Get the globally installed memory system for sensitive data, if it has been installed. + */ + AWS_CORE_API MemorySystemInterface* GetSensitiveMemorySystem(); + /** * Get the pointer to the SDK default memory system */ diff --git a/src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSAllocator.h b/src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSAllocator.h index efa1c8340f84..321af725941d 100644 --- a/src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSAllocator.h +++ b/src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSAllocator.h @@ -98,6 +98,56 @@ namespace Aws template< typename T > using Allocator = std::allocator; #endif // USE_AWS_MEMORY_MANAGEMENT + + template + class SensitiveAllocator + { + public: + typedef T value_type; + + SensitiveAllocator() throw() {} + + template + SensitiveAllocator(const SensitiveAllocator&) throw() {} + + T* allocate(std::size_t n) + { + Aws::Utils::Memory::MemorySystemInterface* memorySystem = Aws::Utils::Memory::GetSensitiveMemorySystem(); + if (memorySystem) + { + return reinterpret_cast(memorySystem->AllocateMemory(n * sizeof(T), alignof(T), "AWSSensitive")); + } + return reinterpret_cast(malloc(n * sizeof(T))); + } + + void deallocate(T* p, std::size_t n) + { + AWS_UNREFERENCED_PARAM(n); + + Aws::Utils::Memory::MemorySystemInterface* memorySystem = Aws::Utils::Memory::GetSensitiveMemorySystem(); + if (memorySystem) + { + memorySystem->FreeMemory(p); + } + else + { + free(p); + } + } + }; + + template< typename T, typename U > + bool operator ==(const SensitiveAllocator< T >&, const SensitiveAllocator< U >&) + { + return true; + } + + template< typename T, typename U > + bool operator !=(const SensitiveAllocator< T >&, const SensitiveAllocator< U >&) + { + return false; + } + /** * Creates a shared_ptr using AWS Allocator hooks. * allocationTag is for memory tracking purposes. diff --git a/src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSString.h b/src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSString.h index 8b6b691b8489..67aa97a5fc6a 100644 --- a/src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSString.h +++ b/src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSString.h @@ -102,6 +102,8 @@ using WString = std::basic_string< wchar_t, std::char_traits< wchar_t >, Aws::Al #endif // __ANDROID +using SensitiveString = std::basic_string< char, std::char_traits< char >, Aws::SensitiveAllocator< char > >; + } // namespace Aws #ifdef USE_AWS_MEMORY_MANAGEMENT diff --git a/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/AwsCredentialsProviderIdentityResolver.h b/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/AwsCredentialsProviderIdentityResolver.h index dc72fd068f33..bd50b38fba29 100644 --- a/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/AwsCredentialsProviderIdentityResolver.h +++ b/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/AwsCredentialsProviderIdentityResolver.h @@ -37,7 +37,7 @@ namespace smithy auto smithyCreds = Aws::MakeUnique("AwsCredentialsProviderIdentityResolver", fetchedCreds.GetAWSAccessKeyId(), - fetchedCreds.GetAWSSecretKey(), + Aws::String(fetchedCreds.GetAWSSecretKey().data(), fetchedCreds.GetAWSSecretKey().size()), fetchedCreds.GetSessionToken(), fetchedCreds.GetExpiration(), fetchedCreds.GetAccountId()); diff --git a/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/DefaultAwsCredentialIdentityResolver.h b/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/DefaultAwsCredentialIdentityResolver.h index 560a2960ae44..76f283fde057 100644 --- a/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/DefaultAwsCredentialIdentityResolver.h +++ b/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/DefaultAwsCredentialIdentityResolver.h @@ -46,7 +46,8 @@ class DefaultAwsCredentialIdentityResolver : public AwsCredentialIdentityResolve auto legacyCreds = legacyChain_sp->GetAWSCredentials(); auto smithyCreds = Aws::MakeUnique( - "DefaultAwsCredentialIdentityResolver", legacyCreds.GetAWSAccessKeyId(), legacyCreds.GetAWSSecretKey(), + "DefaultAwsCredentialIdentityResolver", legacyCreds.GetAWSAccessKeyId(), + Aws::String(legacyCreds.GetAWSSecretKey().data(), legacyCreds.GetAWSSecretKey().size()), legacyCreds.GetSessionToken().empty() ? Aws::Crt::Optional() : legacyCreds.GetSessionToken(), legacyCreds.GetExpiration(), legacyCreds.GetAccountId().empty() ? Aws::Crt::Optional() : legacyCreds.GetAccountId()); diff --git a/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/SimpleAwsCredentialIdentityResolver.h b/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/SimpleAwsCredentialIdentityResolver.h index 0ef61d8cc3b4..33ead0354f03 100644 --- a/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/SimpleAwsCredentialIdentityResolver.h +++ b/src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/SimpleAwsCredentialIdentityResolver.h @@ -35,7 +35,7 @@ namespace smithy auto smithyCreds = Aws::MakeUnique("SimpleAwsCredentialIdentityResolver", m_credentials.GetAWSAccessKeyId(), - m_credentials.GetAWSSecretKey(), + Aws::String(m_credentials.GetAWSSecretKey().data(), m_credentials.GetAWSSecretKey().size()), m_credentials.GetSessionToken().empty()? Aws::Crt::Optional() : m_credentials.GetSessionToken(), m_credentials.GetExpiration(), m_credentials.GetAccountId().empty()? Aws::Crt::Optional() : m_credentials.GetAccountId()); diff --git a/src/aws-cpp-sdk-core/source/Aws.cpp b/src/aws-cpp-sdk-core/source/Aws.cpp index 9042176df8a7..747dd94abe05 100644 --- a/src/aws-cpp-sdk-core/source/Aws.cpp +++ b/src/aws-cpp-sdk-core/source/Aws.cpp @@ -50,6 +50,10 @@ namespace Aws Aws::Utils::Memory::InitializeAWSMemorySystem(Utils::Memory::GetDefaultMemorySystem()); } #endif // USE_AWS_MEMORY_MANAGEMENT + if(options.memoryManagementOptions.sensitiveMemoryManager) + { + Aws::Utils::Memory::InitializeAWSSensitiveMemorySystem(*options.memoryManagementOptions.sensitiveMemoryManager); + } Aws::Client::CoreErrorsMapper::InitCoreErrorsMapper(); if(options.loggingOptions.logLevel != Aws::Utils::Logging::LogLevel::Off) { @@ -223,6 +227,10 @@ namespace Aws Aws::Utils::Logging::PushLogger(nullptr); // stops further logging but keeps old logger object alive } Aws::Utils::Logging::ShutdownAWSLogging(); + if(options.memoryManagementOptions.sensitiveMemoryManager) + { + Aws::Utils::Memory::ShutdownAWSSensitiveMemorySystem(); + } #ifdef USE_AWS_MEMORY_MANAGEMENT if(options.memoryManagementOptions.memoryManager) { diff --git a/src/aws-cpp-sdk-core/source/auth/signer/AWSAuthEventStreamV4Signer.cpp b/src/aws-cpp-sdk-core/source/auth/signer/AWSAuthEventStreamV4Signer.cpp index cf39123eebf7..04b9b9ccc828 100644 --- a/src/aws-cpp-sdk-core/source/auth/signer/AWSAuthEventStreamV4Signer.cpp +++ b/src/aws-cpp-sdk-core/source/auth/signer/AWSAuthEventStreamV4Signer.cpp @@ -293,13 +293,12 @@ Aws::String AWSAuthEventStreamV4Signer::GenerateStringToSign(const Aws::String& return ss.str(); } -Aws::Utils::ByteBuffer AWSAuthEventStreamV4Signer::ComputeHash(const Aws::String& secretKey, +Aws::Utils::ByteBuffer AWSAuthEventStreamV4Signer::ComputeHash(const Aws::SensitiveString& secretKey, const Aws::String& simpleDate, const Aws::String& region, const Aws::String& serviceName) const { - Aws::String signingKey(Aws::Auth::AWSAuthHelper::SIGNING_KEY); + Aws::SensitiveString signingKey(Aws::Auth::AWSAuthHelper::SIGNING_KEY); signingKey.append(secretKey); - auto hashResult = HashingUtils::CalculateSHA256HMAC(ByteBuffer((unsigned char*)simpleDate.c_str(), simpleDate.length()), - ByteBuffer((unsigned char*)signingKey.c_str(), signingKey.length())); + auto hashResult = HashingUtils::CalculateSHA256HMAC(simpleDate, signingKey); if (hashResult.GetLength() == 0) { diff --git a/src/aws-cpp-sdk-core/source/auth/signer/AWSAuthV4Signer.cpp b/src/aws-cpp-sdk-core/source/auth/signer/AWSAuthV4Signer.cpp index bcca2d2e602f..b9934c176739 100644 --- a/src/aws-cpp-sdk-core/source/auth/signer/AWSAuthV4Signer.cpp +++ b/src/aws-cpp-sdk-core/source/auth/signer/AWSAuthV4Signer.cpp @@ -548,10 +548,10 @@ Aws::String AWSAuthV4Signer::GenerateStringToSign(const Aws::String& dateValue, return ss.str(); } -Aws::Utils::ByteBuffer AWSAuthV4Signer::ComputeHash(const Aws::String& secretKey, +Aws::Utils::ByteBuffer AWSAuthV4Signer::ComputeHash(const Aws::SensitiveString& secretKey, const Aws::String& simpleDate, const Aws::String& region, const Aws::String& serviceName) const { - Aws::String signingKey(Aws::Auth::AWSAuthHelper::SIGNING_KEY); + Aws::SensitiveString signingKey(Aws::Auth::AWSAuthHelper::SIGNING_KEY); signingKey.append(secretKey); auto kDate = HashingUtils::CalculateSHA256HMAC(simpleDate, signingKey); diff --git a/src/aws-cpp-sdk-core/source/utils/HashingUtils.cpp b/src/aws-cpp-sdk-core/source/utils/HashingUtils.cpp index a2ce52a2021d..9d50a6f1f745 100644 --- a/src/aws-cpp-sdk-core/source/utils/HashingUtils.cpp +++ b/src/aws-cpp-sdk-core/source/utils/HashingUtils.cpp @@ -18,6 +18,7 @@ #include #include #include +#include #include @@ -48,6 +49,23 @@ ByteBuffer HashingUtils::CalculateSHA256HMAC(const ByteBuffer& toSign, const Byt return hash.Calculate(toSign, secret).GetResult(); } +ByteBuffer HashingUtils::CalculateSHA256HMAC(const Aws::String& toSign, const Aws::SensitiveString& secret) +{ + auto toSignCur = Aws::Crt::ByteCursorFromArray(reinterpret_cast(toSign.data()), toSign.size()); + auto secretCur = Aws::Crt::ByteCursorFromArray(reinterpret_cast(secret.data()), secret.size()); + + ByteBuffer resultBuf(Aws::Crt::Crypto::SHA256_HMAC_DIGEST_SIZE); + Aws::Crt::ByteBuf outBuf = Aws::Crt::ByteBufFromEmptyArray(resultBuf.GetUnderlyingData(), resultBuf.GetSize()); + + if (Aws::Crt::Crypto::ComputeSHA256HMAC(secretCur, toSignCur, outBuf)) + { + resultBuf.SetLength(outBuf.len); + return resultBuf; + } + + return {}; +} + ByteBuffer HashingUtils::CalculateSHA512(const Aws::String& str) { Sha512 hash; diff --git a/src/aws-cpp-sdk-core/source/utils/memory/AWSMemory.cpp b/src/aws-cpp-sdk-core/source/utils/memory/AWSMemory.cpp index 074450f4e2d0..b63c7c186677 100644 --- a/src/aws-cpp-sdk-core/source/utils/memory/AWSMemory.cpp +++ b/src/aws-cpp-sdk-core/source/utils/memory/AWSMemory.cpp @@ -16,6 +16,7 @@ using namespace Aws::Utils::Memory; #ifdef USE_AWS_MEMORY_MANAGEMENT static MemorySystemInterface* AWSMemorySystem(nullptr); #endif // USE_AWS_MEMORY_MANAGEMENT +static MemorySystemInterface* AWSSensitiveMemorySystem(nullptr); namespace Aws { @@ -59,6 +60,31 @@ MemorySystemInterface* GetMemorySystem() #endif // USE_AWS_MEMORY_MANAGEMENT } +void InitializeAWSSensitiveMemorySystem(MemorySystemInterface& memorySystem) +{ + if(AWSSensitiveMemorySystem != nullptr) + { + AWSSensitiveMemorySystem->End(); + } + + AWSSensitiveMemorySystem = &memorySystem; + AWSSensitiveMemorySystem->Begin(); +} + +void ShutdownAWSSensitiveMemorySystem(void) +{ + if(AWSSensitiveMemorySystem != nullptr) + { + AWSSensitiveMemorySystem->End(); + } + AWSSensitiveMemorySystem = nullptr; +} + +MemorySystemInterface* GetSensitiveMemorySystem() +{ + return AWSSensitiveMemorySystem; +} + #if defined(__cpp_exceptions) || defined(_CPPUNWIND) || defined(__EXCEPTIONS) #define AWS_HAS_EXCEPTIONS #endif