ios - 以编程方式将默认加密 KMS 添加到存储桶

Question

我使用 AWS SDK iOS v2.6.21 以编程方式将 KMS (SSE-KMS) 加密添加到 AWS S3 存储桶。我使用以下 Objective-C 代码执行此操作:

AWSS3 *awsClient = [AWSS3 S3ForKey:bucketObject.regionShortName];
AWSS3ServerSideEncryptionRule *rule= [AWSS3ServerSideEncryptionRule new];
AWSS3ServerSideEncryptionByDefault *applyServerSideEncryptionByDefault =[AWSS3ServerSideEncryptionByDefault new];applyServerSideEncryptionByDefault.SSEAlgorithm=AWSS3ServerSideEncryptionAwsKms;

applyServerSideEncryptionByDefault.KMSMasterKeyID=kmsAliasKeyId;
AWSS3ServerSideEncryptionConfiguration *configuration = 
[AWSS3ServerSideEncryptionConfiguration new];
configuration.rules = @[rule];

AWSS3PutBucketEncryptionRequest *request = 
[AWSS3PutBucketEncryptionRequest new];
request.bucket = bucketObject.name;
request.serverSideEncryptionConfiguration=configuration;

[awsClient putBucketEncryption:request];

这似乎有效并显示我的存储桶具有默认加密。但是，它没有指定加密是 KMS，它只是显示加密已打开的复选标记(在查看控制台时)。

当我以编程方式检查加密状态时，它没有为 SSEAlgorithm 指定任何内容:

<AWSS3ServerSideEncryptionConfiguration: 0x604000008790> {
    rules =     (
        "<AWSS3ServerSideEncryptionRule: 0x6040000087f0> {\n}"
    );
}

根据 AWS SDK 中 AWSS3ServerSideEncryption 的定义方式，我预计显示 SSEAlgorithm 的输出为 2:

AWSS3ServerSideEncryption:
AWSS3ServerSideEncryptionUnknown,
AWSS3ServerSideEncryptionAES256,
AWSS3ServerSideEncryptionAwsKms,

当我使用 SSE-S3 (AWSS3ServerSideEncryptionAES256) 执行相同代码时比较输出，输出为:

<AWSS3ServerSideEncryptionConfiguration: 0x600000009c40> {
    rules =     (
        "<AWSS3ServerSideEncryptionRule: 0x600000009c50> {\n    
applyServerSideEncryptionByDefault = \"<AWSS3ServerSideEncryptionByDefault: 0x60000022b6a0> {\\n    SSEAlgorithm = 1;\\n}\";\n}"
    );
}

任何人都可以看到我在正确使用 KMS 作为整个存储桶的默认加密的请求中缺少什么吗？

谢谢。干杯，特隆德

Answer 1

您已正确设置所有对象，期待在规则上关联加密的步骤。请参阅下面的代码，了解您需要进行哪些更改才能正确设置它。

...
...
...

AWSS3ServerSideEncryptionRule *rule= [AWSS3ServerSideEncryptionRule new];

AWSS3ServerSideEncryptionByDefault *applyServerSideEncryptionByDefault =[AWSS3ServerSideEncryptionByDefault new];
applyServerSideEncryptionByDefault.SSEAlgorithm=AWSS3ServerSideEncryptionAwsKms;
applyServerSideEncryptionByDefault.KMSMasterKeyID=kmsAliasKeyId;

//Add the encryption information to the rule
rule.applyServerSideEncryptionByDefault = applyServerSideEncryptionByDefault;


AWSS3ServerSideEncryptionConfiguration *configuration = 

...
...
...