drone-cache icon indicating copy to clipboard operation
drone-cache copied to clipboard

S3 buckets with KMS encryption require explicit endpoint configuration

Open hhamalai opened this issue 3 years ago • 0 comments

Is your feature request related to a problem? Please describe. When using S3 buckets with KMS SSE turned on for drone-cache, the drone manifest requires explicit definition for S3 endpoint with https schema. This is due to:

  1. KMS SSE backed buckets require secure transport or else they will throw an error: Requests specifying Server Side Encryption with AWS KMS managed keys must be made over a secure connection.
  2. https://github.com/meltwater/drone-cache/blob/f32236f59d82da069f1b8f6f89ae5e9e8c8b7651/storage/backend/s3/s3.go#L38 Will set DisableSSL to false, unless endpoint is explicitly defined.

Describe the solution you'd like I would like to see default SSL on everywhere, and to have explicit configuration in order to disable it. Using default, implicit S3 endpoints should preferred.

Describe alternatives you've considered There could be an explicit configuration flag to turn on / off SSL.

hhamalai avatar Nov 10 '20 10:11 hhamalai