amazon-web-services - KMS 加密后 Aws S3 etag 不匹配 md5

Question

全部 - 我们正在努力将一些 secret 和监管信息从本地 UNIX 文件系统迁移到 S3。

使用“aws s3 cp--sse aws:kms --sse-kms-key-id ......”命令使用 AWS EC2 实例将文件复制到 S3。

我注意到 etag 与 unix md5sum 不同。如果我不使用 kms key 加密数据，则完全相同。

我需要验证上传以确保数据在上传到 S3 时没有损坏，我该如何验证我的文件是否完好无损，因为 etag 由于加密而无法匹配。

非常感谢任何帮助!

PS:我的文件不是 > 5gb，我知道分段上传的问题，它不适用于我....

Answer 1

在 AWS S3 中，etag 不是 MD5 校验和。如果只是碰巧过去是这种情况，但 AWS 警告不要依赖这种方法进行完整性检查。

以下链接是我所指的文本:

ETag 可能是也可能不是对象数据的 MD5 摘要。

The entity tag is a hash of the object. The ETag reflects changes only to the contents of an object, not its metadata. The ETag may or may not be an MD5 digest of the object data. Whether or not it is depends on how the object was created and how it is encrypted as described below:

• Objects created by the PUT Object, POST Object, or Copy operation, or through the AWS Management Console, and are encrypted by SSE-S3 or plaintext, have ETags that are an MD5 digest of their object data.

• Objects created by the PUT Object, POST Object, or Copy operation, or through the AWS Management Console, and are encrypted by SSE-C or SSE-KMS, have ETags that are not an MD5 digest of their object data.

• If an object is created by either the Multipart Upload or Part Copy operation, the ETag is not an MD5 digest, regardless of the method of encryption.

Common Response Headers