-
SSE-S3
-
SSE-KMS
-
SSE-C
不关心密钥在哪是什么, S3完全内部处理
#使用托管的aws/kms
aws s3api put-object --bucket emr.cuteworld.top --key sse/sses3.obj --body a.txt --server-side-encryption AES256
#output
{
"ETag": "\"4a470309809c421ed970b16fcd921974\"",
"ServerSideEncryption": "AES256"
}
这里需要跟AWS KMS的customer managed keys区分开来. 无论是使用aws/kms这种服务托管的key, 还是采用 AWS Kms托管的CMK, 这种都是 SSE-KMS.
#使用托管的aws/kms
aws s3api put-object --bucket emr.cuteworld.top --key sse/ssekms.obj --body a.txt --server-side-encryption aws:kms
#指定keyId
aws s3api put-object --bucket emr.cuteworld.top --key sse/x --server-side-encryption aws:kms --ssekms-key-id mrk-f424d5d9d32f42db945378266270a6b3
{
"ETag": "\"0ef02c50759a4584128b3c26ce655393\"",
"ServerSideEncryption": "aws:kms",
"SSEKMSKeyId": "arn:aws:kms:us-east-2:390468416359:key/mrk-f424d5d9d32f42db945378266270a6b3",
"BucketKeyEnabled": true
}
aws s3api put-object --bucket emr.cuteworld.top --key sse/ssecms.obj --body a.txt --sse-customer-algorithm AES256 --sse-customer-key MUwg/uvG1kIIuByJUISHnAm8TK4sA+PR
#
aws s3api put-object --acl public-read --sse-customer-algorithm=AES256 --sse-customer-key=MUwg/uvG1kIIuByJUISHnAm8TK4sA+PR --body ~/Downloads/copied/CNC.mp4 --bucket decipherers --key gmdata-dev/hugeVideo.mp4
自己提供一个完全与AWS KMS服务无关的符合条件的 AES256的secret key. 在put-object和get-object的时候, 都必须带着这个secret key.
MUwg/uvG1kIIuByJUISHnAm8TK4sA+PR 这是一个可以工作的sse-customer-key. 到底是需要什么格式的
#上传
aws s3api put-object --bucket emr.cuteworld.top --key sse/sse-c.obj --body a.txt --sse-customer-algorithm AES256 --sse-customer-key MUwg/uvG1kIIuByJUISHnAm8TK4sA+PR
#返回
{
"ETag": "\"b97b50b7c9805150068e3f36afd44302\"",
"SSECustomerAlgorithm": "AES256",
"SSECustomerKeyMD5": "nnd7u25CkQx4oUdgF1strw=="
}
# 获取
aws s3api get-object --bucket emr.cuteworld.top --key sse/sse-c.obj --sse-customer-algorithm AES256 --sse-customer-key MUwg/uvG1kIIuByJUISHnAm8TK4sA+PR hello
获取内容并写入到名为hello的文件里面去
# 通过 --debug 可以看到 https 请求
PUT
/emr.cuteworld.top/sse/sse-c.obj
content-md5:SkcDCYCcQh7ZcLFvzZIZdA==
host:s3.us-east-2.amazonaws.com
x-amz-content-sha256:UNSIGNED-PAYLOAD
x-amz-date:20220424T140353Z
x-amz-server-side-encryption-customer-algorithm:AES256
x-amz-server-side-encryption-customer-key:TVV3Zy91dkcxa0lJdUJ5SlVJU0huQW04VEs0c0ErUFI=
x-amz-server-side-encryption-customer-key-md5:nnd7u25CkQx4oUdgF1strw==
这里注意:
命令参数 | 命令参数值 | https headers值 |
---|---|---|
--sse-customer-key | MUwg/uvG1kIIuByJUISHnAm8TK4sA+PR | x-amz-server-side-encryption-customer-key:TVV3Zy91dkcxa0lJdUJ5SlVJU0huQW04VEs0c0ErUFI= |
--sse-customer-algorithm | AES256 | x-amz-server-side-encryption-customer-algorithm:AES256 |
AWS CLI自动完成 key的md5值 | nnd7u25CkQx4oUdgF1strw== |
在上传之前完成数据加密, 并将加密后的数据存入S3.