feat(encryption/kms): Add AWS KMS client

Cargo.toml

@@ -23,6 +23,7 @@ members = [
   "crates/iceberg",
   "crates/integration_tests",
   "crates/integrations/*",
+  "crates/kms",
   "crates/property-macro",
   "crates/storage/*",
   "crates/test_utils",
@@ -59,15 +60,21 @@ arrow-select = "59.2"
 arrow-string = "59.2"
 as-any = "0.3.2"
 async-trait = "0.1.89"
-aws-config = "1.8.7"
+aws-config = "1.9"
 aws-sdk-glue = { version = "1.85", default-features = false, features = [
   "default-https-client",
   "rt-tokio",
 ] }
+aws-sdk-kms = { version = "1.123", default-features = false, features = [
+  "default-https-client",
+  "rt-tokio",
+] }
 aws-sdk-s3tables = { version = "1.28", default-features = false, features = [
   "default-https-client",
   "rt-tokio",
 ] }
+aws-smithy-http-client = "1.5"
+aws-smithy-mocks = "0.3"
 backon = "1.5.1"
 base64 = "0.22.1"
 bimap = "0.6"

README.md

@@ -37,6 +37,7 @@ The Apache Iceberg Rust project is composed of the following components:
 | [iceberg-catalog-s3tables]    | [![iceberg-catalog-s3tables image]][iceberg-catalog-s3tables link]       | [![docs release]][iceberg-catalog-s3tables release docs] [![docs dev]][iceberg-catalog-s3tables dev docs]       |
 | [iceberg-catalog-sql]         | [![iceberg-catalog-sql image]][iceberg-catalog-sql link]                 | [![docs release]][iceberg-catalog-sql release docs] [![docs dev]][iceberg-catalog-sql dev docs]                 |
 | [iceberg-cache-moka]          | [![iceberg-cache-moka image]][iceberg-cache-moka link]                   | [![docs release]][iceberg-cache-moka release docs] [![docs dev]][iceberg-cache-moka dev docs]                   |
+| [iceberg-kms]                 | [![iceberg-kms image]][iceberg-kms link]                                 | [![docs release]][iceberg-kms release docs] [![docs dev]][iceberg-kms dev docs]                                 |
 | [iceberg-storage-opendal]     | [![iceberg-storage-opendal image]][iceberg-storage-opendal link]         | [![docs release]][iceberg-storage-opendal release docs] [![docs dev]][iceberg-storage-opendal dev docs]         |
 
 [docs release]: https://img.shields.io/badge/docs-release-blue
@@ -95,6 +96,12 @@ The Apache Iceberg Rust project is composed of the following components:
 [iceberg-cache-moka release docs]: https://docs.rs/iceberg-cache-moka
 [iceberg-cache-moka dev docs]: https://rust.iceberg.apache.org/api/iceberg_cache_moka/
 
+[iceberg-kms]: crates/kms/README.md
+[iceberg-kms image]: https://img.shields.io/crates/v/iceberg-kms.svg
+[iceberg-kms link]: https://crates.io/crates/iceberg-kms
+[iceberg-kms release docs]: https://docs.rs/iceberg-kms
+[iceberg-kms dev docs]: https://rust.iceberg.apache.org/api/iceberg_kms/
+
 ## Iceberg Rust Implementation Status
 
 The features that Iceberg Rust currently supports can be found [here](https://iceberg.apache.org/status/).

crates/kms/Cargo.toml

@@ -0,0 +1,63 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+[package]
+edition = { workspace = true }
+homepage = { workspace = true }
+name = "iceberg-kms"
+publish = true
+readme = "README.md"
+rust-version = { workspace = true }
+version = { workspace = true }
+
+categories = ["database"]
+description = "Key management service integrations for Apache Iceberg client-side encryption"
+keywords = ["iceberg", "kms", "encryption"]
+license = { workspace = true }
+repository = { workspace = true }
+
+[package.metadata.docs.rs]
+all-features = true
+
+[features]
+aws = [
+  "dep:async-trait",
+  "dep:aws-config",
+  "dep:aws-sdk-kms",
+  "dep:base64",
+  "dep:http",
+  "dep:iceberg-property-macro",
+]
+default = []
+
+[dependencies]
+async-trait = { workspace = true, optional = true }
+aws-config = { workspace = true, optional = true }
+aws-sdk-kms = { workspace = true, optional = true }
+base64 = { workspace = true, optional = true }
+http = { workspace = true, optional = true }
+iceberg = { workspace = true }
+iceberg-property-macro = { workspace = true, optional = true }
+
+[dev-dependencies]
+aws-sdk-kms = { workspace = true, features = ["test-util"] }
+aws-smithy-http-client = { workspace = true, features = ["test-util"] }
+aws-smithy-mocks = { workspace = true }
+tokio = { workspace = true, features = ["macros"] }
+
+[lints]
+workspace = true