S3 default integrity protection change and server-side encryption compatibility #5830
Closed
1 task done
Assignees
Labels
bug
This issue is a bug.
p1
This is a high priority issue
potential-regression
Marking this issue as a potential regression to be checked by team member
response-requested
Waiting on additional info and feedback. Will move to "closing-soon" in 10 days.
Comments
msi591
added
bug
bhoradc
added
p1
|
Hello @msi591, Thank you for reporting the issue.
public class Main {
public static void main(String[] args) throws NoSuchAlgorithmException {
S3Client s3Client = null;
try {
final var bucket = "<<bucketname>>";
final var key = "<<key>>";
final var path = new File("/Users/*****/<<key>>.txt");
s3Client = S3Client.builder()
.region(Region.US_EAST_1)
.build();
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
keyGen.init(256);
SecretKey secretKey = keyGen.generateKey();
String sseCustomerKey = Base64.getEncoder().encodeToString(secretKey.getEncoded());
MessageDigest md = MessageDigest.getInstance("MD5");
byte[] md5Hash = md.digest(secretKey.getEncoded());
String sseCustomerKeyMd5 = Base64.getEncoder().encodeToString(md5Hash);
PutObjectRequest putObjectRequest = PutObjectRequest.builder()
.bucket(bucket)
.key(key)
.sseCustomerAlgorithm("AES256")
.sseCustomerKey(sseCustomerKey)
.sseCustomerKeyMD5(sseCustomerKeyMd5)
.build();
s3Client.putObject(putObjectRequest, RequestBody.fromFile(path));
} catch (NoSuchAlgorithmException e) {
System.err.println("Cryptographic algorithm is not available: " + e.getMessage());
} catch (S3Exception e) {
System.err.println("Error during S3 operation: " + e.getMessage());
} catch (Exception e) {
System.err.println("Unexpected error occurred: " + e.getMessage());
e.printStackTrace();
} finally {
if (s3Client != null) {
s3Client.close();
}
}
}
}Let me know if you have further inputs on this. Regards, |
bhoradc
added
the
response-requested
|
Hi bhoradc! Yes sorry, I forgot to specify that I'm connecting to a third-party S3-compatible service. So I understand that default checksum calculation and sse-c encryption should be compatible. For my part, downgrading java sdk to v2.29.50 solved the problem (as well as setting requestChecksumCalculation and responseChecksumValidation parameters to WHEN_REQUIRED with v2.30.6). |
|
Thank you for the confirmation. Hence closing the issue. |
|
This issue is now closed. Comments on closed issues are hard for our team to see. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
From version 2.30.0 (#5802), our putObject requests no longer work with server-side encryption (SSE-C).
Should they be compatible, I didn't find a clear answer in AWS documentation?
The problem goes away setting requestChecksumCalculation and responseChecksumValidation parameters to
WHEN_REQUIRED.Regression Issue
Expected Behavior
PutObject requests upload files with sse-c encryption
Current Behavior
S3Exception: Invalid Argument (Service: S3, Status Code: 400):
Reproduction Steps
Possible Solution
No response
Additional Information/Context
No response
AWS Java SDK version used
2.30.6
JDK version used
openjdk 21.0.5 2024-10-15 LTS
Operating System and version
Ubuntu 24.04.1 LTS
The text was updated successfully, but these errors were encountered: