[jhoppenstedt]

Description

Adding support for one master encryption key for S3 SSE-C (sending the key to a public S3 provider). This change doesn't include migration tooling for existing S3 storage backends.

Copied from the AWS documentation

S3 API headers required for SSE-C object encryption and decryption requests
You must provide the following three API headers to encrypt or decrypt objects with SSE-C:

• x-amz-server-side-encryption-customer-algorithm Use this header to specify the encryption algorithm. The header value must be AES256.
• x-amz-server-side-encryption-customer-key Use this header to provide the 256-bit, base64-encoded encryption key for Amazon S3 to use to encrypt or decrypt your data.
• x-amz-server-side-encryption-customer-key-MD5 Use this header to provide the base64-encoded 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.

References

• feat: support SSE-C encryption in S3 blobstores reva#919
• AWS Documentation

Related Issue

• Fixes [FR] Support SSE-C with decomposeds3 #632

Motivation and Context

I want to use public S3 providers as storage backend. Bigger ones like AWS or OVH support their own managed key solution but I want to have the key under my control. So S3 SSE-C it is: Sending the encryption key with every S3 request.

How Has This Been Tested?

Tested the changes against a locally running MinIO S3 backend.
Uploaded a file via the UI and tried downloading via AWS CLI

Succesful download with SSE-C Key

$> aws s3api get-object \
  --bucket opencloud-bucket \
  --key "$S3_OBJECT" \
  --sse-customer-algorithm AES256 \
  --sse-customer-key "$SSEC_KEY_FILE" \
  --query '{Algorithm:SSECustomerAlgorithm,KeyMD5:SSECustomerKeyMD5}' \
  download.txt
{
    "Algorithm": "AES256",
    "KeyMD5": "pGd5xPgbIz30JBpXz5KvsQ=="
}

# File downloaded

Failure without SSE-C Key

$> aws s3api get-object \
  --bucket opencloud-bucket \
  --key "$S3_OBJECT" \
  --query '{Algorithm:SSECustomerAlgorithm,KeyMD5:SSECustomerKeyMD5}' \
  download.txt

aws: [ERROR]: An error occurred (InvalidRequest) when calling the GetObject operation: The object was stored using a form of Server Side Encryption. The correct parameters must be provided to retrieve the object.

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation added

[codacy-production]

Not up to standards ⛔

🔴 Issues 3 critical

Alerts:
⚠ 3 issues (≤ 0 issues of at least minor severity)

Results:
3 new issues

Category	Results
Security	3 critical

View in Codacy

🟢 Metrics 61 complexity

Metric	Results
Complexity	61

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}