Menentukan enkripsi di sisi server dengan kunci terkelola Amazon S3 (SSE-S3)

Ketika Anda menggunakan AWS SDK untuk Java untuk meng-upload objek, Anda dapat menggunakan SSE-S3 untuk mengenkripsi itu. Untuk meminta enkripsi di sisi server, gunakan properti ObjectMetadata dari PutObjectRequest untuk menetapkan header permintaan x-amz-server-side-encryption. Saat Anda memanggil putObject() metode dari AmazonS3Client, Amazon S3 mengenkripsi dan menyimpan data.

Anda juga dapat meminta enkripsi SSE-S3 saat mengunggah objek menggunakan operasi API pengunggahan multibagian:

Anda tidak dapat langsung mengubah status enkripsi suatu objek (mengenkripsi objek yang tidak dienkripsi atau mendekripsi objek yang dienkripsi). Untuk mengubah status enkripsi objek, Anda membuat salinan objek, dengan menentukan status enkripsi yang diinginkan untuk salinan, lalu hapus objek asli. Amazon S3 mengenkripsi objek yang disalin hanya jika Anda secara eksplisit meminta enkripsi di sisi server. Untuk meminta enkripsi objek yang disalin melalui API Java, gunakan properti ObjectMetadata untuk menentukan enkripsi di sisi server dalam CopyObjectRequest.

import com.amazonaws.AmazonServiceException;
import com.amazonaws.SdkClientException;
import com.amazonaws.auth.profile.ProfileCredentialsProvider;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;
import com.amazonaws.services.s3.internal.SSEResultBase;
import com.amazonaws.services.s3.model.*;

import java.io.ByteArrayInputStream;

public class SpecifyServerSideEncryption {

    public static void main(String[] args) {
        Regions clientRegion = Regions.DEFAULT_REGION;
        String bucketName = "*** Bucket name ***";
        String keyNameToEncrypt = "*** Key name for an object to upload and encrypt ***";
        String keyNameToCopyAndEncrypt = "*** Key name for an unencrypted object to be encrypted by copying ***";
        String copiedObjectKeyName = "*** Key name for the encrypted copy of the unencrypted object ***";

        try {
            AmazonS3 s3Client = AmazonS3ClientBuilder.standard()
                    .withRegion(clientRegion)
                    .withCredentials(new ProfileCredentialsProvider())
                    .build();

            // Upload an object and encrypt it with SSE.
            uploadObjectWithSSEEncryption(s3Client, bucketName, keyNameToEncrypt);

            // Upload a new unencrypted object, then change its encryption state
            // to encrypted by making a copy.
            changeSSEEncryptionStatusByCopying(s3Client,
                    bucketName,
                    keyNameToCopyAndEncrypt,
                    copiedObjectKeyName);
        } catch (AmazonServiceException e) {
            // The call was transmitted successfully, but Amazon S3 couldn't process
            // it, so it returned an error response.
            e.printStackTrace();
        } catch (SdkClientException e) {
            // Amazon S3 couldn't be contacted for a response, or the client
            // couldn't parse the response from Amazon S3.
            e.printStackTrace();
        }
    }

    private static void uploadObjectWithSSEEncryption(AmazonS3 s3Client, String bucketName, String keyName) {
        String objectContent = "Test object encrypted with SSE";
        byte[] objectBytes = objectContent.getBytes();

        // Specify server-side encryption.
        ObjectMetadata objectMetadata = new ObjectMetadata();
        objectMetadata.setContentLength(objectBytes.length);
        objectMetadata.setSSEAlgorithm(ObjectMetadata.AES_256_SERVER_SIDE_ENCRYPTION);
        PutObjectRequest putRequest = new PutObjectRequest(bucketName,
                keyName,
                new ByteArrayInputStream(objectBytes),
                objectMetadata);

        // Upload the object and check its encryption status.
        PutObjectResult putResult = s3Client.putObject(putRequest);
        System.out.println("Object \"" + keyName + "\" uploaded with SSE.");
        printEncryptionStatus(putResult);
    }

    private static void changeSSEEncryptionStatusByCopying(AmazonS3 s3Client,
            String bucketName,
            String sourceKey,
            String destKey) {
        // Upload a new, unencrypted object.
        PutObjectResult putResult = s3Client.putObject(bucketName, sourceKey, "Object example to encrypt by copying");
        System.out.println("Unencrypted object \"" + sourceKey + "\" uploaded.");
        printEncryptionStatus(putResult);

        // Make a copy of the object and use server-side encryption when storing the
        // copy.
        CopyObjectRequest request = new CopyObjectRequest(bucketName,
                sourceKey,
                bucketName,
                destKey);
        ObjectMetadata objectMetadata = new ObjectMetadata();
        objectMetadata.setSSEAlgorithm(ObjectMetadata.AES_256_SERVER_SIDE_ENCRYPTION);
        request.setNewObjectMetadata(objectMetadata);

        // Perform the copy operation and display the copy's encryption status.
        CopyObjectResult response = s3Client.copyObject(request);
        System.out.println("Object \"" + destKey + "\" uploaded with SSE.");
        printEncryptionStatus(response);

        // Delete the original, unencrypted object, leaving only the encrypted copy in
        // Amazon S3.
        s3Client.deleteObject(bucketName, sourceKey);
        System.out.println("Unencrypted object \"" + sourceKey + "\" deleted.");
    }

    private static void printEncryptionStatus(SSEResultBase response) {
        String encryptionStatus = response.getSSEAlgorithm();
        if (encryptionStatus == null) {
            encryptionStatus = "Not encrypted with SSE";
        }
        System.out.println("Object encryption status is: " + encryptionStatus);
    }
}

Saat mengunggah sebuah objek, Anda dapat mengarahkan Amazon S3 untuk mengenkripsinya. Untuk mengubah status enkripsi objek yang sudah ada, Anda membuat salinan objek dan menghapus objek sumber. Secara default, operasi penyalinan mengenkripsi target hanya jika Anda secara eksplisit meminta enkripsi di sisi server objek target. Untuk menentukan SSE-S3 di CopyObjectRequest, tambahkan yang berikut ini:

 ServerSideEncryptionMethod = ServerSideEncryptionMethod.AES256

Untuk sampel kerja tentang cara menyalin objek, lihat Menggunakan AWS SDKs.

Contoh berikut mengunggah objek. Dalam permintaan, contoh tersebut mengarahkan Amazon S3 untuk mengenkripsi objek. Contoh tersebut kemudian mengambil metadata objek dan memverifikasi metode enkripsi yang digunakan. Untuk informasi tentang menyiapkan dan menjalankan contoh kode, lihat Memulai SDK for .NET di AWSAWS SDK for .NET Developer Guide.

using Amazon;
using Amazon.S3;
using Amazon.S3.Model;
using System;
using System.Threading.Tasks;

namespace Amazon.DocSamples.S3
{
    class SpecifyServerSideEncryptionTest
    {
        private const string bucketName = "*** bucket name ***";
        private const string keyName = "*** key name for object created ***";
        // Specify your bucket region (an example region is shown).
        private static readonly RegionEndpoint bucketRegion = RegionEndpoint.USWest2;
        private static IAmazonS3 client;

        public static void Main()
        {
            client = new AmazonS3Client(bucketRegion);
            WritingAnObjectAsync().Wait();
        }

        static async Task WritingAnObjectAsync()
        {
            try
            {
                var putRequest = new PutObjectRequest
                {
                    BucketName = bucketName,
                    Key = keyName,
                    ContentBody = "sample text",
                    ServerSideEncryptionMethod = ServerSideEncryptionMethod.AES256
                };

                var putResponse = await client.PutObjectAsync(putRequest);

                // Determine the encryption state of an object.
                GetObjectMetadataRequest metadataRequest = new GetObjectMetadataRequest
                {
                    BucketName = bucketName,
                    Key = keyName
                };
                GetObjectMetadataResponse response = await client.GetObjectMetadataAsync(metadataRequest);
                ServerSideEncryptionMethod objectEncryption = response.ServerSideEncryptionMethod;

                Console.WriteLine("Encryption method used: {0}", objectEncryption.ToString());
            }
            catch (AmazonS3Exception e)
            {
                Console.WriteLine("Error encountered ***. Message:'{0}' when writing an object", e.Message);
            }
            catch (Exception e)
            {
                Console.WriteLine("Unknown encountered on server. Message:'{0}' when writing an object", e.Message);
            }
        }
    }
}

Topik ini menunjukkan cara menggunakan kelas dari versi 3 AWS SDK untuk PHP untuk menambahkan SSE-S3 ke objek yang Anda unggah ke Amazon S3. Untuk informasi selengkapnya tentang AWS SDK for Ruby API, AWS buka SDK for Ruby - Versi 2.

Untuk mengunggah objek ke Amazon S3, gunakan metode Aws\S3\S3Client::putObject(). Untuk menambahkan x-amz-server-side-encryption header permintaan ke permintaan pengunggahan, tentukan parameter ServerSideEncryption dengan nilai AES256, seperti yang ditunjukkan dalam contoh kode berikut. Untuk informasi lebih lanjut tentang permintaan enkripsi di sisi server, lihat Penggunaan API REST.

 require 'vendor/autoload.php';

use Aws\S3\S3Client;

$bucket = '*** Your Bucket Name ***';
$keyname = '*** Your Object Key ***';

// $filepath should be an absolute path to a file on disk.
$filepath = '*** Your File Path ***';

$s3 = new S3Client([
    'version' => 'latest',
    'region'  => 'us-east-1'
]);

// Upload a file with server-side encryption.
$result = $s3->putObject([
    'Bucket'               => $bucket,
    'Key'                  => $keyname,
    'SourceFile'           => $filepath,
    'ServerSideEncryption' => 'AES256',
]);

Sebagai respons, Amazon S3 mengembalikan header x-amz-server-side-encryption dengan nilai algoritma enkripsi yang digunakan untuk mengenkripsi data objek Anda.

Saat mengunggah objek besar dengan menggunakan operasi API unggahan multibagian, Anda dapat menentukan SSE-S3 untuk objek yang Anda unggah, sebagai berikut ini:

Untuk menentukan status enkripsi objek yang ada, ambil metadata objek dengan memanggil metode Aws\S3\S3Client::headObject() seperti yang ditunjukkan dalam contoh kode PHP berikut.

 require 'vendor/autoload.php';

use Aws\S3\S3Client;

$bucket = '*** Your Bucket Name ***';
$keyname = '*** Your Object Key ***';

$s3 = new S3Client([
    'version' => 'latest',
    'region'  => 'us-east-1'
]);

// Check which server-side encryption algorithm is used.
$result = $s3->headObject([
    'Bucket' => $bucket,
    'Key'    => $keyname,
]);
echo $result['ServerSideEncryption'];

Untuk mengubah status enkripsi objek yang sudah ada, buat salinan objek menggunakan metode Aws\S3\S3Client::copyObject() dan menghapus objek sumber. Secara default, copyObject() tidak mengenkripsi target kecuali jika Anda secara eksplisit meminta enkripsi di sisi server objek tujuan menggunakan parameter ServerSideEncryption dengan nilai AES256. Contoh kode PHP berikut membuat salinan objek dan menambahkan enkripsi server-side ke objek yang tersalin.

 require 'vendor/autoload.php';

use Aws\S3\S3Client;

$sourceBucket = '*** Your Source Bucket Name ***';
$sourceKeyname = '*** Your Source Object Key ***';

$targetBucket = '*** Your Target Bucket Name ***';
$targetKeyname = '*** Your Target Object Key ***';

$s3 = new S3Client([
    'version' => 'latest',
    'region'  => 'us-east-1'
]);

// Copy an object and add server-side encryption.
$s3->copyObject([
    'Bucket'               => $targetBucket,
    'Key'                  => $targetKeyname,
    'CopySource'           => "$sourceBucket/$sourceKeyname",
    'ServerSideEncryption' => 'AES256',
]);

Untuk informasi selengkapnya, lihat topik berikut:

Saat menggunakan AWS SDK untuk Ruby untuk mengunggah objek, Anda dapat menentukan bahwa objek disimpan terenkripsi saat istirahat dengan SSE-S3. Saat Anda membaca kembali, objek tersebut akan didekripsi secara otomatis.

Contoh AWS SDK untuk Ruby Versi 3 berikut menunjukkan cara menentukan bahwa file yang diunggah ke Amazon S3 dienkripsi saat istirahat.

require 'aws-sdk-s3'

# Wraps Amazon S3 object actions.
class ObjectPutSseWrapper
  attr_reader :object

  # @param object [Aws::S3::Object] An existing Amazon S3 object.
  def initialize(object)
    @object = object
  end

  def put_object_encrypted(object_content, encryption)
    @object.put(body: object_content, server_side_encryption: encryption)
    true
  rescue Aws::Errors::ServiceError => e
    puts "Couldn't put your content to #{object.key}. Here's why: #{e.message}"
    false
  end
end

# Example usage:
def run_demo
  bucket_name = "amzn-s3-demo-bucket"
  object_key = "my-encrypted-content"
  object_content = "This is my super-secret content."
  encryption = "AES256"

  wrapper = ObjectPutSseWrapper.new(Aws::S3::Object.new(bucket_name, object_content))
  return unless wrapper.put_object_encrypted(object_content, encryption)

  puts "Put your content into #{bucket_name}:#{object_key} and encrypted it with #{encryption}."
end

run_demo if $PROGRAM_NAME == __FILE__

Contoh kode berikut menunjukkan cara menentukan status enkripsi objek yang ada.

require 'aws-sdk-s3'

# Wraps Amazon S3 object actions.
class ObjectGetEncryptionWrapper
  attr_reader :object

  # @param object [Aws::S3::Object] An existing Amazon S3 object.
  def initialize(object)
    @object = object
  end

  # Gets the object into memory.
  #
  # @return [Aws::S3::Types::GetObjectOutput, nil] The retrieved object data if successful; otherwise nil.
  def object
    @object.get
  rescue Aws::Errors::ServiceError => e
    puts "Couldn't get object #{@object.key}. Here's why: #{e.message}"
  end
end

# Example usage:
def run_demo
  bucket_name = "amzn-s3-demo-bucket"
  object_key = "my-object.txt"

  wrapper = ObjectGetEncryptionWrapper.new(Aws::S3::Object.new(bucket_name, object_key))
  obj_data = wrapper.get_object
  return unless obj_data

  encryption = obj_data.server_side_encryption.nil? ? 'no' : obj_data.server_side_encryption
  puts "Object #{object_key} uses #{encryption} encryption."
end

run_demo if $PROGRAM_NAME == __FILE__

Jika enkripsi di sisi server tidak digunakan untuk objek yang disimpan di Amazon S3, metode tersebut akan menghasilkan null.

Untuk mengubah status enkripsi objek yang ada, buat salinan objek tersebut dan hapus objek sumber. Secara default, metode penyalinan tidak mengenkripsi target kecuali Anda secara eksplisit meminta enkripsi di sisi server. Anda dapat meminta enkripsi objek target dengan menentukan nilai server_side_encryption dalam argumen hash opsi, seperti yang ditunjukkan dalam contoh kode Ruby berikut. Contoh kode mendemonstrasikan cara menyalin sebuah objek dan mengenkripsi salinan dengan SSE-S3.

require 'aws-sdk-s3'

# Wraps Amazon S3 object actions.
class ObjectCopyEncryptWrapper
  attr_reader :source_object

  # @param source_object [Aws::S3::Object] An existing Amazon S3 object. This is used as the source object for
  #                                        copy actions.
  def initialize(source_object)
    @source_object = source_object
  end

  # Copy the source object to the specified target bucket, rename it with the target key, and encrypt it.
  #
  # @param target_bucket [Aws::S3::Bucket] An existing Amazon S3 bucket where the object is copied.
  # @param target_object_key [String] The key to give the copy of the object.
  # @return [Aws::S3::Object, nil] The copied object when successful; otherwise, nil.
  def copy_object(target_bucket, target_object_key, encryption)
    @source_object.copy_to(bucket: target_bucket.name, key: target_object_key, server_side_encryption: encryption)
    target_bucket.object(target_object_key)
  rescue Aws::Errors::ServiceError => e
    puts "Couldn't copy #{@source_object.key} to #{target_object_key}. Here's why: #{e.message}"
  end
end

# Example usage:
def run_demo
  source_bucket_name = "amzn-s3-demo-bucket1"
  source_key = "my-source-file.txt"
  target_bucket_name = "amzn-s3-demo-bucket2"
  target_key = "my-target-file.txt"
  target_encryption = "AES256"

  source_bucket = Aws::S3::Bucket.new(source_bucket_name)
  wrapper = ObjectCopyEncryptWrapper.new(source_bucket.object(source_key))
  target_bucket = Aws::S3::Bucket.new(target_bucket_name)
  target_object = wrapper.copy_object(target_bucket, target_key, target_encryption)
  return unless target_object

  puts "Copied #{source_key} from #{source_bucket_name} to #{target_object.bucket_name}:#{target_object.key} and "\
       "encrypted the target with #{target_object.server_side_encryption} encryption."
end

run_demo if $PROGRAM_NAME == __FILE__