java - 无法使用 AES 服务器端加密将对象上传到 S3

Question

我正在尝试通过 Java API 将对象上传到 S3 存储桶。但是无论我做什么，它都会抛出 Access Denied 异常

private static void serverSideEncryption() throws NoSuchAlgorithmException {
    AmazonS3 S3_CLIENT = AmazonS3ClientBuilder.standard()
                                              .withCredentials(new AWSStaticCredentialsProvider(awsCreds))
                                              .withRegion(Regions.US_EAST_1)
                                              .build();
    PutObjectRequest putRequest = new PutObjectRequest(BUCKET_NAME, "dfsdf.ss",
            new File("/Users/fsdfs/Desktop/test.jpeg"));
    S3_CLIENT.putObject(putRequest);
    System.out.println("Object uploaded");
}

当我运行它时，我得到了

Exception in thread "main" com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: AD1105A291B609D8; S3 Extended Request ID: Ls5wbbW2Yd43p75MJGSOjex0KvmgPiqNBupxpCcEvdMRkK4iptNPNCEwyOqokA=), S3 Extended Request ID: Ls5wbbW2Yd43p75MJGSOje70iqNBupxpCcEvdMRkK4iptNPNCEwyOqokA=
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1632)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1304)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1058)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:743)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:717)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649)
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513)
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:4365)
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:4312)
    at com.amazonaws.services.s3.AmazonS3Client.putObject(AmazonS3Client.java:1755)
    at com.xxx.aws.s3.S3Service.serverSideEncryption(S3Service.java:72)
    at com.xxx.aws.s3.S3Service.main(S3Service.java:58)

但是，如果我使用

从 AWS CLI 执行相同的操作

aws s3api put-object --bucket zzz-yyy-xxx --key test/testfdf --server-side-encryption AES256

它工作得很好。

我也试过下面的代码

private static void serverSideEncryption() throws NoSuchAlgorithmException {
    KEY_GENERATOR = KeyGenerator.getInstance("AES");
    KEY_GENERATOR.init(256, new SecureRandom());
    SSE_KEY = new SSECustomerKey(KEY_GENERATOR.generateKey());
    AmazonS3 S3_CLIENT = AmazonS3ClientBuilder.standard()
                                              .withCredentials(new AWSStaticCredentialsProvider(awsCreds))
                                              .withRegion(Regions.US_EAST_1)
                                              .build();
    PutObjectRequest putRequest = new PutObjectRequest(BUCKET_NAME, "dfsdf.ss",
            new File("/Users/xx-xx/Desktop/dfdf.jpeg")).withSSECustomerKey(SSE_KEY);
    S3_CLIENT.putObject(putRequest);
    System.out.println("Object uploaded");
}

我的存储桶策略设置为 AES 加密

Answer 1

检查您的存储桶名称和访问 key 是否正确，403 表示该 key 不存在。这可能意味着存储桶名称中的 key 或您的访问 key 。

检查两者以确保。

编辑:遵循 AWS S3 SSE 文档 https://atdocs.aws.amazon.com/AmazonS3/latest/dev/SSEUsingJavaSDK.html

为了上传带有服务器端加密的对象，需要使用 ObjectMetaData指定服务器端加密 key 的方法，然后可以将此对象的引用用作 PutObjectRequest 中的参数.

修改归因于 OP https://stackoverflow.com/users/1629109/damien-amen