OfflineCollector: Add S3 upload capability for encrypted buckets

artifacts/definitions/Server/Utils/CreateCollector.yaml

@@ -141,6 +141,7 @@ parameters:
           credentialssecret=TargetArgs.credentialsSecret,
           region=TargetArgs.region,
           endpoint=TargetArgs.endpoint,
+          serversideencryption=TargetArgs.serverSideEncryption,
           noverifycert=TargetArgs.noverifycert)
 
   - name: GCSCollection

gui/velociraptor/src/components/flows/offline-collector.js

@@ -225,7 +225,22 @@ class OfflineCollectorParameters  extends React.Component {
                         />
                       </Col>
                     </Form.Group>
-
+                    <Form.Group as={Row}>
+                      <Form.Label column sm="3">Server Side Encryption</Form.Label>
+                      <Col sm="8">
+                        <Form.Control as="select"
+                                        value={this.props.parameters.target_args.serverSideEncryption}
+                                        onChange={(e) => {
+                                            this.props.parameters.target_args.serverSideEncryption = e.target.value;
+                                            this.props.setParameters(this.props.parameters);
+                                        }}
+                        >
+                            <option value="">None</option>
+                            <option value="aws:kms">aws:kms</option>
+                            <option value="AES256">AES256</option>
+                        </Form.Control>
+                      </Col>
+                    </Form.Group>
                     <Form.Group as={Row}>
                         <Form.Label column sm="3">Skip Cert Verification</Form.Label>
                         <Col sm="8">
@@ -409,6 +424,7 @@ export default class OfflineCollectorWizard extends React.Component {
                 credentialsSecret: "",
                 region: "",
                 endpoint: "",
+                serverSideEncryption: "",
             },
             template: "",
             password: "",

vql/tools/s3_upload.go

@@ -19,15 +19,16 @@ import (
 )
 
 type S3UploadArgs struct {
-	File              string `vfilter:"required,field=file,doc=The file to upload"`
-	Name              string `vfilter:"optional,field=name,doc=The name of the file that should be stored on the server"`
-	Accessor          string `vfilter:"optional,field=accessor,doc=The accessor to use"`
-	Bucket            string `vfilter:"required,field=bucket,doc=The bucket to upload to"`
-	Region            string `vfilter:"required,field=region,doc=The region the bucket is in"`
-	CredentialsKey    string `vfilter:"required,field=credentialskey,doc=The AWS key credentials to use"`
-	CredentialsSecret string `vfilter:"required,field=credentialssecret,doc=The AWS secret credentials to use"`
-	Endpoint          string `vfilter:"optional,field=endpoint,doc=The Endpoint to use"`
-	NoVerifyCert      bool   `vfilter:"optional,field=noverifycert,doc=Skip TLS Verification"`
+	File                 string `vfilter:"required,field=file,doc=The file to upload"`
+	Name                 string `vfilter:"optional,field=name,doc=The name of the file that should be stored on the server"`
+	Accessor             string `vfilter:"optional,field=accessor,doc=The accessor to use"`
+	Bucket               string `vfilter:"required,field=bucket,doc=The bucket to upload to"`
+	Region               string `vfilter:"required,field=region,doc=The region the bucket is in"`
+	CredentialsKey       string `vfilter:"required,field=credentialskey,doc=The AWS key credentials to use"`
+	CredentialsSecret    string `vfilter:"required,field=credentialssecret,doc=The AWS secret credentials to use"`
+	Endpoint             string `vfilter:"optional,field=endpoint,doc=The Endpoint to use"`
+	ServerSideEncryption string `vfilter:"optional,field=serversideencryption,doc=The server side encryption method to use"`
+	NoVerifyCert         bool   `vfilter:"optional,field=noverifycert,doc=Skip TLS Verification"`
 }
 
 type S3UploadFunction struct{}
@@ -84,6 +85,7 @@ func (self *S3UploadFunction) Call(ctx context.Context,
 			arg.CredentialsSecret,
 			arg.Region,
 			arg.Endpoint,
+			arg.ServerSideEncryption,
 			arg.NoVerifyCert)
 		if err != nil {
 			scope.Log("upload_S3: %v", err)
@@ -103,6 +105,7 @@ func upload_S3(ctx context.Context, scope vfilter.Scope,
 	credentialsSecret string,
 	region string,
 	endpoint string,
+	serverSideEncryption string,
 	NoVerifyCert bool) (
 	*api.UploadResponse, error) {
 
@@ -139,13 +142,23 @@ func upload_S3(ctx context.Context, scope vfilter.Scope,
 	}
 
 	uploader := s3manager.NewUploader(sess)
-
-	result, err := uploader.UploadWithContext(
-		ctx, &s3manager.UploadInput{
-			Bucket: aws.String(bucket),
-			Key:    aws.String(name),
-			Body:   reader,
-		})
+	var result *s3manager.UploadOutput
+	if serverSideEncryption != "" {
+		result, err = uploader.UploadWithContext(
+			ctx, &s3manager.UploadInput{
+				Bucket:               aws.String(bucket),
+				Key:                  aws.String(name),
+				ServerSideEncryption: aws.String(serverSideEncryption),
+				Body:                 reader,
+			})
+	} else {
+		result, err = uploader.UploadWithContext(
+			ctx, &s3manager.UploadInput{
+				Bucket: aws.String(bucket),
+				Key:    aws.String(name),
+				Body:   reader,
+			})
+	}
 	if err != nil {
 		return &api.UploadResponse{
 			Error: err.Error(),