S3 Object encryption
Closed this issue · 10 comments
Great library!
I noticed the messages stored in S3 do not have encryption turned on. For the best HIPAA compliance, I think they should be? If this is useful, I could work on it; we'd need to add to the API the ability to set the S3 region.
does it only support client side encryption? how can we enable the sever side encryption on S3 with this library?
Hi,
Thanks for opening this issue about encryption. Here is a blog post which shows a way of enabling client-side encryption for the message payload:
At the moment, server-side encryption is not supported by this library. We will be happy to see pull requests for enhancing encryption features.
Hi,
Any plans to include server-side encryption in this library's feature set in the future? It's a blocker for some who use exclusively SSE on their S3 buckets.
Do you need SSE for HIPAA compliance? If it helps, AWS just released that SQS is now HIPAA compliant: https://aws.amazon.com/about-aws/whats-new/2017/05/amazon-simple-queue-service-sqs-is-now-a-hipaa-eligible-service/
There are multiple compliance factors at work here. The (real) scenario is that company X has a requirement to encrypt all S3 objects. Usually they use SSE for this. They enforce this using a bucket policy in S3 requiring server-side encryption. This doesn't work for client-side encryption because S3 has no way of knowing whether the data was encrypted prior to receiving it. It only works for SSE because a header is passed (x-amz-server-side-encryption) telling S3 to encrypt it. They want to use SQS to handle larger payloads and this library seems the only option.
Any plans to expand this library to allow SSE?
It shouldn't be too hard to modify this library yourself - I've since left the project where we were working with this code, but I hacked the lib to do SSE (also hacked in our own amazon helper functions, so can't paste code easily here). Glancing through the codebase:
AmazonSQSExtendedClient.java -> storeTextInS3 -> ObjectMetadata variable is the only thing that needs to be modified for encryption. Also I remember needing to set the region for the amazon client so that it is able to do encryption; not sure where that goes. But I think that's about it...
Just announced today, you can now configure default encryption on an S3 bucket directly: https://aws.amazon.com/blogs/aws/new-amazon-s3-encryption-security-features/, to ensure any puts to S3 will land encrypted even if the client doesn't specify encryption parameters.
+1
Hi! Version 1.1.0 now uses the Payload Offloading Java Common Library For AWS (https://github.com/awslabs/payload-offloading-java-common-lib-for-aws) which allows to configure S3 Server Side Encryption with KMS.
Will be closing this issue for now.