parse SSEKMSKeyId from store url and pass to store config #323
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds in support for
SSEKMSKeyIdby parsing it from the store url and passing it into theS3StoreConfig. Done analogously to theSSEparamater.Also added a unit test for
parseStoreArgswhich checks that theSSEKMSKeyIdfield (amongst others) is correctly parsed from the store URLAdditional Testing:
Ran
TestStoreInteractionsusingSSEandSSEKMSKeyIdparameters on a bucket with SSE KMS + key. Used this structure as the fragment store:s3://bucket-with-kms-key/?find=rwFind&replace=rwReplace&endpoint=https://region.amazonaws.com&sse=aws:kms&ssekmskeyid=test-key")wheretest-keymatched the one onbucket-with-kms-key. The test ran successfully and was able toPersist, List, Open/Read, and Deleteobjects from the bucket.With the above setup, I removed the deletion portion of the test so that the encrypted objects would remain in the bucket. I then attempted through the CLI to call
get-objects, once with a role without permissions to decrypt the objects and once with a role with permission to decrypt the objects. (*Note the kms key does not actually need to be passed in, rather the role calling the endpoint needs to have permissions to decrypt the object (source)).The result for the role without decryption perms was:
An error occurred (AccessDenied) when calling the GetObject operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.And the result for the role with decryption perms was a successful download.
This is in evidence of the
Persistcorrectly using theSSEKMSKeyIdpassed in from the fragment store to authorize decryptionThis change is