使用服务器端加密更新对象上的 S3 KMS 密钥答案

【问题标题】：Update S3 KMS key on an object using server side encryption使用服务器端加密更新对象上的 S3 KMS 密钥
【发布时间】：2019-09-03 14:47:49
【问题描述】：

我正在开发一项功能，客户可以在我们的平台上更新他们的 KMS 密钥，以便他们使用他们的 KMS 密钥来加密数据，而不是我们生成的数据。它的工作方式是当客户注册时，我们为他们生成一个 KMS 密钥并使用该密钥上传对象。如果客户想提供自己的密钥，我希望能够更新此密钥，而无需拉下数据并使用新密钥重新上传。

def enc_client
  Aws::S3::Encryption::Client.new(
    kms_client: Aws::KMS::Client.new(region: 'us-east-1'),
    kms_key_id: ENV['MY_PRIVATE_KEY']
  )
end

def s3_client
  enc_client.client
end

bucket = "my_bucket_name"
key = "path/12345abcde/preview.html"
copy_source = "/#{key}"
server_side_encryption = "aws:kms"

# This returns the object with the key present. If I go in the AWS client and manually add or remove the key, it will update on this call.
resp = s3_client.get_object(bucket: bucket, key: key)

#<struct Aws::S3::Types::GetObjectOutput
 body=#<StringIO:0x000000000bb45108>,
 delete_marker=nil,
 accept_ranges="bytes",
 expiration=nil,
 restore=nil,
 last_modified=2019-04-12 15:40:09 +0000,
 content_length=19863445,
 etag="\"123123123123123123123123123123-1\"",
 missing_meta=nil,
 version_id=nil,
 cache_control=nil,
 content_disposition="inline; filename=\"preview.html\"",
 content_encoding=nil,
 content_language=nil,
 content_range=nil,
 content_type="text/html",
 expires=nil,
 expires_string=nil,
 website_redirect_location=nil,
 server_side_encryption="aws:kms",
 metadata={},
 sse_customer_algorithm=nil,
 sse_customer_key_md5=nil,
 ssekms_key_id="arn:aws:kms:us-east-1:123456789123:key/222b222b-bb22-2222-bb22-222bbb22bb2b",
 storage_class=nil,
 request_charged=nil,
 replication_status=nil,
 parts_count=nil,
 tag_count=nil>

new_ssekms_key_id = "arn:aws:kms:us-east-1:123456789123:key/111a111a-aa11-1111-aa11-111aaa11aa1a"


resp = s3_client.copy_object(bucket: bucket, key: key, copy_source: copy_source, ssekms_key_id: ssekms_key_id)
Aws::S3::Errors::InvalidArgument: Server Side Encryption with AWS KMS managed key requires HTTP header x-amz-server-side-encryption : aws:kms
from /usr/local/bundle/gems/aws-sdk-core-3.6.0/lib/seahorse/client/plugins/raise_response_errors.rb:15:in `call'


resp = s3_client.copy_object(bucket: bucket, key: key, copy_source: copy_source, ssekms_key_id: ssekms_key_id, server_side_encryption: server_side_encryption)
Aws::S3::Errors::AccessDenied: Access Denied
from /usr/local/bundle/gems/aws-sdk-core-3.6.0/lib/seahorse/client/plugins/raise_response_errors.rb:15:in `call'

我希望能够在服务器端更新 kms id 做一个新的

【问题讨论】：

标签： ruby amazon-web-services amazon-s3

【解决方案1】：

copy_source = "/#{key}" 不正确。该值应为"/#{bucket}/#{key}"。

该服务将您的密钥路径的第一个元素解释为存储桶的名称——可能是其他人的存储桶。

【讨论】：