Skip to content

Commit a00b8b0

Browse files
author
awstools
committedSep 18, 2024
feat(client-s3): Added SSE-KMS support for directory buckets.
1 parent 900a39e commit a00b8b0

17 files changed

+840
-360
lines changed
 

‎clients/client-s3/src/commands/CompleteMultipartUploadCommand.ts

+8-7
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,11 @@ export interface CompleteMultipartUploadCommandOutput extends CompleteMultipartU
8585
* information about permissions required to use the multipart upload API, see
8686
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html">Multipart Upload and
8787
* Permissions</a> in the <i>Amazon S3 User Guide</i>.</p>
88+
* <p>If you provide an <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_Checksum.html">additional checksum
89+
* value</a> in your <code>MultipartUpload</code> requests and the
90+
* object is encrypted with Key Management Service, you must have permission to use the
91+
* <code>kms:Decrypt</code> action for the
92+
* <code>CompleteMultipartUpload</code> request to succeed.</p>
8893
* </li>
8994
* <li>
9095
* <p>
@@ -94,13 +99,9 @@ export interface CompleteMultipartUploadCommandOutput extends CompleteMultipartU
9499
* Amazon Web Services CLI or SDKs create session and refresh the session token automatically to avoid service interruptions when a session expires. For more information about authorization, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateSession.html">
95100
* <code>CreateSession</code>
96101
* </a>.</p>
97-
* </li>
98-
* <li>
99-
* <p> If you provide an <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_Checksum.html">additional checksum
100-
* value</a> in your <code>MultipartUpload</code> requests and the
101-
* object is encrypted with Key Management Service, you must have permission to use the
102-
* <code>kms:Decrypt</code> action for the
103-
* <code>CompleteMultipartUpload</code> request to succeed.</p>
102+
* <p>If the object is encrypted with
103+
* SSE-KMS, you must also have the
104+
* <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permissions in IAM identity-based policies and KMS key policies for the KMS key.</p>
104105
* </li>
105106
* </ul>
106107
* </dd>

‎clients/client-s3/src/commands/CopyObjectCommand.ts

+3
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,9 @@ export interface CopyObjectCommandOutput extends CopyObjectOutput, __MetadataBea
132132
* key can't be set to <code>ReadOnly</code> on the copy destination bucket. </p>
133133
* </li>
134134
* </ul>
135+
* <p>If the object is encrypted with
136+
* SSE-KMS, you must also have the
137+
* <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permissions in IAM identity-based policies and KMS key policies for the KMS key.</p>
135138
* <p>For example policies, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam-example-bucket-policies.html">Example bucket policies for S3 Express One Zone</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam-identity-policies.html">Amazon Web Services Identity and Access Management (IAM) identity-based policies for S3 Express One Zone</a> in the
136139
* <i>Amazon S3 User Guide</i>.</p>
137140
* </li>

‎clients/client-s3/src/commands/CreateMultipartUploadCommand.ts

+21-1
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,27 @@ export interface CreateMultipartUploadCommandOutput extends CreateMultipartUploa
216216
* </li>
217217
* <li>
218218
* <p>
219-
* <b>Directory buckets</b> -For directory buckets, only server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) is supported.</p>
219+
* <b>Directory buckets</b> - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) and server-side encryption with KMS keys (SSE-KMS) (<code>aws:kms</code>). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your
220+
* <code>CreateSession</code> requests or <code>PUT</code> object requests. Then, new objects
221+
* are automatically encrypted with the desired encryption settings. For more
222+
* information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-serv-side-encryption.html">Protecting data with server-side encryption</a> in the <i>Amazon S3 User Guide</i>. For more information about the encryption overriding behaviors in directory buckets, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-specifying-kms-encryption.html">Specifying server-side encryption with KMS for new object uploads</a>.</p>
223+
* <p>In the Zonal endpoint API calls (except <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html">CopyObject</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPartCopy.html">UploadPartCopy</a>) using the REST API, the encryption request headers must match the encryption settings that are specified in the <code>CreateSession</code> request.
224+
* You can't override the values of the encryption settings (<code>x-amz-server-side-encryption</code>, <code>x-amz-server-side-encryption-aws-kms-key-id</code>, <code>x-amz-server-side-encryption-context</code>, and <code>x-amz-server-side-encryption-bucket-key-enabled</code>) that are specified in the <code>CreateSession</code> request.
225+
* You don't need to explicitly specify these encryption settings values in Zonal endpoint API calls, and
226+
* Amazon S3 will use the encryption settings values from the <code>CreateSession</code> request to protect new objects in the directory bucket.
227+
* </p>
228+
* <note>
229+
* <p>When you use the CLI or the Amazon Web Services SDKs, for <code>CreateSession</code>, the session token refreshes automatically to avoid service interruptions when a session expires. The CLI or the Amazon Web Services SDKs use the bucket's default encryption configuration for the
230+
* <code>CreateSession</code> request. It's not supported to override the encryption settings values in the <code>CreateSession</code> request.
231+
* So in the Zonal endpoint API calls (except <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html">CopyObject</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPartCopy.html">UploadPartCopy</a>),
232+
* the encryption request headers must match the default encryption configuration of the directory bucket.
233+
*
234+
* </p>
235+
* </note>
236+
* <note>
237+
* <p>For directory buckets, when you perform a <code>CreateMultipartUpload</code> operation and an <code>UploadPartCopy</code> operation,
238+
* the request headers you provide in the <code>CreateMultipartUpload</code> request must match the default encryption configuration of the destination bucket. </p>
239+
* </note>
220240
* </li>
221241
* </ul>
222242
* </dd>

‎clients/client-s3/src/commands/CreateSessionCommand.ts

+51-8
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,12 @@ import { Command as $Command } from "@smithy/smithy-client";
66
import { MetadataBearer as __MetadataBearer } from "@smithy/types";
77

88
import { commonParams } from "../endpoint/EndpointParameters";
9-
import { CreateSessionOutput, CreateSessionOutputFilterSensitiveLog, CreateSessionRequest } from "../models/models_0";
9+
import {
10+
CreateSessionOutput,
11+
CreateSessionOutputFilterSensitiveLog,
12+
CreateSessionRequest,
13+
CreateSessionRequestFilterSensitiveLog,
14+
} from "../models/models_0";
1015
import { de_CreateSessionCommand, se_CreateSessionCommand } from "../protocols/Aws_restXml";
1116
import { S3ClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../S3Client";
1217

@@ -29,16 +34,16 @@ export interface CreateSessionCommandInput extends CreateSessionRequest {}
2934
export interface CreateSessionCommandOutput extends CreateSessionOutput, __MetadataBearer {}
3035

3136
/**
32-
* <p>Creates a session that establishes temporary security credentials to support fast authentication and authorization for the Zonal endpoint APIs on directory buckets.
33-
* For more information about Zonal endpoint APIs that include the Availability Zone in the request endpoint, see
37+
* <p>Creates a session that establishes temporary security credentials to support fast authentication and authorization for the Zonal endpoint API operations on directory buckets.
38+
* For more information about Zonal endpoint API operations that include the Availability Zone in the request endpoint, see
3439
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-APIs.html">S3 Express One Zone APIs</a> in the <i>Amazon S3 User Guide</i>.
3540
* </p>
3641
* <p>To make Zonal endpoint API requests on a directory bucket, use the <code>CreateSession</code>
3742
* API operation. Specifically, you grant <code>s3express:CreateSession</code> permission to a
3843
* bucket in a bucket policy or an IAM identity-based policy. Then, you use IAM credentials to make the
3944
* <code>CreateSession</code> API request on the bucket, which returns temporary security
4045
* credentials that include the access key ID, secret access key, session token, and
41-
* expiration. These credentials have associated permissions to access the Zonal endpoint APIs. After
46+
* expiration. These credentials have associated permissions to access the Zonal endpoint API operations. After
4247
* the session is created, you don’t need to use other policies to grant permissions to each
4348
* Zonal endpoint API individually. Instead, in your Zonal endpoint API requests, you sign your requests by
4449
* applying the temporary security credentials of the session to the request headers and
@@ -62,12 +67,12 @@ export interface CreateSessionCommandOutput extends CreateSessionOutput, __Metad
6267
* <li>
6368
* <p>
6469
* <b>
65-
* <code>CopyObject</code> API operation</b> - Unlike other Zonal endpoint APIs, the <code>CopyObject</code> API operation doesn't use the temporary security credentials returned from the <code>CreateSession</code> API operation for authentication and authorization. For information about authentication and authorization of the <code>CopyObject</code> API operation on directory buckets, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html">CopyObject</a>.</p>
70+
* <code>CopyObject</code> API operation</b> - Unlike other Zonal endpoint API operations, the <code>CopyObject</code> API operation doesn't use the temporary security credentials returned from the <code>CreateSession</code> API operation for authentication and authorization. For information about authentication and authorization of the <code>CopyObject</code> API operation on directory buckets, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html">CopyObject</a>.</p>
6671
* </li>
6772
* <li>
6873
* <p>
6974
* <b>
70-
* <code>HeadBucket</code> API operation</b> - Unlike other Zonal endpoint APIs, the <code>HeadBucket</code> API operation doesn't use the temporary security credentials returned from the <code>CreateSession</code> API operation for authentication and authorization. For information about authentication and authorization of the <code>HeadBucket</code> API operation on directory buckets, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html">HeadBucket</a>.</p>
75+
* <code>HeadBucket</code> API operation</b> - Unlike other Zonal endpoint API operations, the <code>HeadBucket</code> API operation doesn't use the temporary security credentials returned from the <code>CreateSession</code> API operation for authentication and authorization. For information about authentication and authorization of the <code>HeadBucket</code> API operation on directory buckets, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html">HeadBucket</a>.</p>
7176
* </li>
7277
* </ul>
7378
* </note>
@@ -84,7 +89,37 @@ export interface CreateSessionCommandOutput extends CreateSessionOutput, __Metad
8489
* </a>. For example policies, see
8590
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam-example-bucket-policies.html">Example bucket policies for S3 Express One Zone</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam-identity-policies.html">Amazon Web Services Identity and Access Management (IAM) identity-based policies for S3 Express One Zone</a> in the
8691
* <i>Amazon S3 User Guide</i>. </p>
87-
* <p>To grant cross-account access to Zonal endpoint APIs, the bucket policy should also grant both accounts the <code>s3express:CreateSession</code> permission.</p>
92+
* <p>To grant cross-account access to Zonal endpoint API operations, the bucket policy should also grant both accounts the <code>s3express:CreateSession</code> permission.</p>
93+
* <p>If you want to encrypt objects with SSE-KMS, you must also have the <code>kms:GenerateDataKey</code> and the <code>kms:Decrypt</code> permissions in IAM identity-based policies and KMS key policies for the target KMS key.</p>
94+
* </dd>
95+
* <dt>Encryption</dt>
96+
* <dd>
97+
* <p>For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) and server-side encryption with KMS keys (SSE-KMS) (<code>aws:kms</code>). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your
98+
* <code>CreateSession</code> requests or <code>PUT</code> object requests. Then, new objects
99+
* are automatically encrypted with the desired encryption settings. For more
100+
* information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-serv-side-encryption.html">Protecting data with server-side encryption</a> in the <i>Amazon S3 User Guide</i>. For more information about the encryption overriding behaviors in directory buckets, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-specifying-kms-encryption.html">Specifying server-side encryption with KMS for new object uploads</a>.</p>
101+
* <p>For <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-differences.html#s3-express-differences-api-operations">Zonal endpoint (object-level) API operations</a> except <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html">CopyObject</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPartCopy.html">UploadPartCopy</a>,
102+
* you authenticate and authorize requests through <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateSession.html">CreateSession</a> for low latency.
103+
* To encrypt new objects in a directory bucket with SSE-KMS, you must specify SSE-KMS as the directory bucket's default encryption configuration with a KMS key (specifically, a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>). Then, when a session is created for Zonal endpoint API operations, new objects are automatically encrypted and decrypted with SSE-KMS and S3 Bucket Keys during the session.</p>
104+
* <note>
105+
* <p>
106+
* Only 1 <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a> is supported per directory bucket for the lifetime of the bucket. <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a> (<code>aws/s3</code>) isn't supported.
107+
* After you specify SSE-KMS as your bucket's default encryption configuration with a customer managed key, you can't change the customer managed key for the bucket's SSE-KMS configuration.
108+
* </p>
109+
* </note>
110+
* <p>In the Zonal endpoint API calls (except <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html">CopyObject</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPartCopy.html">UploadPartCopy</a>) using the REST API,
111+
* you can't override the values of the encryption settings (<code>x-amz-server-side-encryption</code>, <code>x-amz-server-side-encryption-aws-kms-key-id</code>, <code>x-amz-server-side-encryption-context</code>, and <code>x-amz-server-side-encryption-bucket-key-enabled</code>) from the <code>CreateSession</code> request.
112+
* You don't need to explicitly specify these encryption settings values in Zonal endpoint API calls, and
113+
* Amazon S3 will use the encryption settings values from the <code>CreateSession</code> request to protect new objects in the directory bucket.
114+
* </p>
115+
* <note>
116+
* <p>When you use the CLI or the Amazon Web Services SDKs, for <code>CreateSession</code>, the session token refreshes automatically to avoid service interruptions when a session expires. The CLI or the Amazon Web Services SDKs use the bucket's default encryption configuration for the
117+
* <code>CreateSession</code> request. It's not supported to override the encryption settings values in the <code>CreateSession</code> request.
118+
* Also, in the Zonal endpoint API calls (except <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html">CopyObject</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPartCopy.html">UploadPartCopy</a>),
119+
* it's not supported to override the values of the encryption settings from the <code>CreateSession</code> request.
120+
*
121+
* </p>
122+
* </note>
88123
* </dd>
89124
* <dt>HTTP Host header syntax</dt>
90125
* <dd>
@@ -102,10 +137,18 @@ export interface CreateSessionCommandOutput extends CreateSessionOutput, __Metad
102137
* const input = { // CreateSessionRequest
103138
* SessionMode: "ReadOnly" || "ReadWrite",
104139
* Bucket: "STRING_VALUE", // required
140+
* ServerSideEncryption: "AES256" || "aws:kms" || "aws:kms:dsse",
141+
* SSEKMSKeyId: "STRING_VALUE",
142+
* SSEKMSEncryptionContext: "STRING_VALUE",
143+
* BucketKeyEnabled: true || false,
105144
* };
106145
* const command = new CreateSessionCommand(input);
107146
* const response = await client.send(command);
108147
* // { // CreateSessionOutput
148+
* // ServerSideEncryption: "AES256" || "aws:kms" || "aws:kms:dsse",
149+
* // SSEKMSKeyId: "STRING_VALUE",
150+
* // SSEKMSEncryptionContext: "STRING_VALUE",
151+
* // BucketKeyEnabled: true || false,
109152
* // Credentials: { // SessionCredentials
110153
* // AccessKeyId: "STRING_VALUE", // required
111154
* // SecretAccessKey: "STRING_VALUE", // required
@@ -152,7 +195,7 @@ export class CreateSessionCommand extends $Command
152195
})
153196
.s("AmazonS3", "CreateSession", {})
154197
.n("S3Client", "CreateSessionCommand")
155-
.f(void 0, CreateSessionOutputFilterSensitiveLog)
198+
.f(CreateSessionRequestFilterSensitiveLog, CreateSessionOutputFilterSensitiveLog)
156199
.ser(se_CreateSessionCommand)
157200
.de(de_CreateSessionCommand)
158201
.build() {

0 commit comments

Comments
 (0)