amazon-s3 - 此操作不支持 x-amz-server-side-encryption header

Question

我正在 AWS AMI 中运行我的应用程序。 AMI 通过云形成模板启动，该模板使用 sts:AssumeRole 创建 AWS::IAM::Role 角色。 EC2 实例启动后，我使用 boto3.create_bucket 从 Ec2 实例创建一个 S3 存储桶。

在我的应用程序中，我将一个文件上传到创建的存储桶，并启用加密标志。但在上传时出现错误:

com.amazonaws.services.s3.model.AmazonS3Exception: x-amz-server-side-encryption header is not supported for this operation. (Service: Amazon S3; Status Code: 400; Error Code: InvalidArgument; Request ID: 04DD9259D04F92CA), S3 Extended Request ID: EVdqFn6jUNshxUejZFWa6VN/lHPXHyi0F+TG+UZ3K9Sh8Gy0MPABi1AnxZloIajypLb39/5UAVA=

这是我的代码的服务器端加密部分:

    ObjectMetadata meta = new ObjectMetadata();
    meta.setContentLength(contentLength);
    meta.setSSEAlgorithm(ObjectMetadata.AES_256_SERVER_SIDE_ENCRYPTION)

我做错了什么？当我在其他地方运行代码并使用 S3 存储桶时，这会按预期工作。这是否与云的形成或 sts:AssumeRole 有关？

Answer 1

The Put object function in boto3具有用于设置对象级加密的选项。

object = bucket.put_object(
    ServerSideEncryption='AES256'|'aws:kms',
    SSECustomerAlgorithm='string',
    SSECustomerKey='string',
    SSEKMSKeyId='string',
)

• ServerSideEncryption (string) -- The Server-side encryption algorithm used when storing this object in S3 (e.g., AES256, aws:kms). StorageClass (string) -- The type of storage to use for the object. Defaults to 'STANDARD'.

• SSECustomerAlgorithm (string) -- Specifies the algorithm to use to when encrypting the object (e.g., AES256).

• SSECustomerKey (string) -- Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded; Amazon does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm header.> -

• SSECustomerKeyMD5 (string) -- Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure the encryption key was transmitted without error. Please note that this parameter is automatically populated if it is not provided. Including this parameter is not required

• SSEKMSKeyId (string) -- Specifies the AWS KMS key ID to use for object encryption. All GET and PUT requests for an object protected by AWS KMS will fail if not made via SSL or using SigV4. Documentation on configuring any of the officially supported AWS SDKs and CLI can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version)

http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html