Java SDK中的Amazon S3 KMS上载

Question

我正在尝试使用AmazonS3服务器端加密(KMS)多部分上传一个文件。我有点困惑，我的代码中是否需要KMS键，如果需要，那么我如何将它添加到Java代码中呢？

--更新私有静态void saveMultipartData（String clientRegion,String bucketName,String awsFilePath,File File）{AmazonS3 s3client=AmazonS3Client.Builder（）.WithReghtml" target="_blank">ion（clientRegion）.WithCredentials（new AWSStaticCredentialsProvider（credentials））.Build（）；

    ObjectMetadata objectMetadata = new ObjectMetadata();
    PutObjectRequest putRequest = null;
    try {
        try {
            putRequest = new PutObjectRequest(bucketName,
                    awsFilePath,
                    new FileInputStream(file),
                    objectMetadata);
        } catch (FileNotFoundException e) {
            e.printStackTrace();
        }
        // Upload the object and check its encryption status.
        putRequest.putCustomRequestHeader("x-amz-server-side-encryption","aws:kms");
        putRequest.putCustomRequestHeader("x-amz-server-side-encryption-aws-kms-key-id","<<keyID>>");

        TransferManager tm = TransferManagerBuilder.standard().withMinimumUploadPartSize(100L).withMultipartUploadThreshold(100L)
                .withS3Client(s3client)
                .build();
        Upload upload = tm.upload(putRequest);

        upload.waitForCompletion();
    } catch (Exception e) {
        e.printStackTrace();
    }
}

Answer 1

虽然您不需要在代码中包含KMS密钥，但您的代码确实需要能够访问该密钥。我的意思是，例如，您使用一个环境变量来传递这个值--这样键就隐藏了。获得密钥后,可以按以下方式执行多部分上载：

InitiateMultipartUploadRequest initRequest = new
                InitiateMultipartUploadRequest(bucketName, keyName);
        initRequest.putCustomRequestHeader("x-amz-server-side-encryption", "aws:kms");
        initRequest.putCustomRequestHeader("x-amz-server-side-encryption-aws-kms-key-id", kmsKey);