[Feature] Add server-side encryption for S3 compatible providers
amold1 opened this issue · comments
Feature (What you would like to be added):
The s3cmd has two flags to have server-side encryption enabled
--server-side-encryption
Specifies that server-side encryption will be used
when putting objects. [put, sync, cp, modify]
--server-side-encryption-kms-id=KMS_KEY
Specifies the key id used for server-side encryption
with AWS KMS-Managed Keys (SSE-KMS) when putting
objects. [put, sync, cp, modify]
Can we add this as part of the aws config?(Unless there exists an option currently)
Motivation (Why is this needed?):
This will enable server-side encryption
Approach/Hint to the implement solution (optional):
Add that as a config option:
Maybe under /home/.aws/creds-file:
{
"accessKeyID": "myaccessid",
"secretAccessKey": "mysecretaccessid",
"region": "myregion",
"endpoint": "myregion.sample.com",
"sse": true,
"sseKey": "myssekey"
}
As stated in the AWS S3 docs for server side encryption
All Amazon S3 buckets have encryption configured by default, and all new objects that are uploaded to an S3 bucket are automatically encrypted at rest. Server-side encryption with Amazon S3 managed keys (SSE-S3) is the default encryption configuration for every bucket in Amazon S3. To use a different type of encryption, you can either specify the type of server-side encryption to use in your S3 PUT requests, or you can set the default encryption configuration in the destination bucket.
S3 already performs server side encryption on data stored by default. For using a different type of encryption instead of using SSE-S3, one can set the encryption configuration in the destination bucket itself, instead of specifying it in each PUT request.
Could you please elaborate on why having this as a part of configuration be necessary? @amold1
As stated in the AWS S3 docs for server side encryption
All Amazon S3 buckets have encryption configured by default, and all new objects that are uploaded to an S3 bucket are automatically encrypted at rest. Server-side encryption with Amazon S3 managed keys (SSE-S3) is the default encryption configuration for every bucket in Amazon S3. To use a different type of encryption, you can either specify the type of server-side encryption to use in your S3 PUT requests, or you can set the default encryption configuration in the destination bucket.
S3 already performs server side encryption on data stored by default. For using a different type of encryption instead of using SSE-S3, one can set the encryption configuration in the destination bucket itself, instead of specifying it in each
PUTrequest.Could you please elaborate on why having this as a part of configuration be necessary? @amold1
My request is to enable this specifically so the S3 compatible providers can also enable this. Amazon S3 does it by default but not other S3 compatible providers(at least the one I am using).
If you're providing AWS credentials to etcd-backup-restore as a JSON file, ideally, what you require should work by just adding a few fields to the awsCredentials struct in s3_snapstore.go
etcd-backup-restore/pkg/snapstore/s3_snapstore.go
Lines 43 to 52 in a73fb83
You could try that out and see if that works as expected for you. If it works as expected, PRs are more than welcome!
The maintainers/contributors won't be working on this since there are a lot of pending issues that require immediate attention.