yas3fs icon indicating copy to clipboard operation
yas3fs copied to clipboard

Add support for S3 customer managed encryption keys

Open bitsofinfo opened this issue 10 years ago • 3 comments

Support should be added for customer provided S3 encryption keys

http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html

bitsofinfo avatar Jul 01 '14 14:07 bitsofinfo

think we go this w/ pull #29 or #45

ewah avatar Nov 17 '14 15:11 ewah

Not done, that was AWS managed keys, this is customer managed

bitsofinfo avatar Nov 17 '14 15:11 bitsofinfo

moved crypto_header logic into base Yas3fs class (on ewah/master).

        crypto_headers = {}$
        if self.aws_managed_encryption:$
            crypto_headers = { 'x-amz-server-side-encryption' : 'AES256' }$
$
        self.default_write_headers = copy.copy(self.default_headers)$
        self.default_write_headers.update(crypto_headers)$

prepping for sse-c-key option.

something like

        crypto_headers = {}
        if self.aws_managed_encryption:
            crypto_headers = { 'x-amz-server-side-encryption' : 'AES256' }
        elif self.client_managed_encryption_key:
            crypto_headers = { 
                 'x-amz-copy-source​-server-side​-encryption​-customer-algorithm' : 'AES256',
                 'x-amz-copy-source​-server-side​-encryption​-customer-key': self.client_managed_encryption_key, 
                 'x-amz-copy-source-​server-side​-encryption​-customer-key-MD5' : md5(self.client_managed_encryption_key)
            }

        self.default_read_headers = copy.copy(self.default_headers)$
        self.default_read_headers.update(crypto_headers)$

        self.default_write_headers = copy.copy(self.default_headers)$
        self.default_write_headers.update(crypto_headers)$

then replacing all the default_headers w/ default_read_headers when necessary.

ewah avatar Nov 17 '14 20:11 ewah