feat(kms): real S3 SSE-KMS + SSM SecureString encryption via KMS hook

[vieiralucas]

Summary

Batch 6b extends the cross-service KMS hook landed in 6a to S3 PutObject/GetObject (SSE-KMS) and SSM PutParameter/GetParameter* (SecureString). Both services now generate a real ciphertext envelope through the hook on write, decrypt on read, and record GenerateDataKey + Decrypt calls in /_fakecloud/kms/usage with the AWS-shaped encryption context the upstream services use.

• S3 SSE-KMS: encryption context `{aws:s3:arn: arn:aws:s3:::}`. Stored body is a fakecloud-kms envelope; ranged reads slice plaintext rather than ciphertext so callers never see the envelope. CopyObject decrypts the source and re-encrypts for the destination's bucket arn, avoiding ciphertext-of-ciphertext when both ends are SSE-KMS.
• SSM SecureString: encryption context `{PARAMETER_ARN: }`. Decrypts via render wrappers in get_parameter / get_parameters / get_parameters_by_path / get_parameter_history when WithDecryption=true. Default key is alias/aws/ssm; auto-provisions on first use.

Both round-trips degrade gracefully on legacy snapshots (decrypt failure returns the stored bytes unchanged).

Test plan

• `cargo test -p fakecloud-e2e --test ssm_kms` (2 new tests)
• `cargo test -p fakecloud-e2e --test s3_sse_kms` (3 new tests, incl. ranged read on SSE-KMS object)
• `cargo test -p fakecloud-ssm` (195 existing pass)
• `cargo test -p fakecloud-s3 --lib` (280 existing pass)
• `cargo clippy --workspace --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• README + service pages + cross-service guide updated

---

Summary by cubic

Adds real KMS-backed encryption for S3 SSE-KMS and SSM SecureString, plus IAM PassRole trust enforcement for Lambda and ECS. KMS errors now fail closed on S3 reads/writes, and auto-provisioned aws/<service> keys persist so ciphertext survives restarts; legacy snapshots still read.

• New Features

  • S3 SSE-KMS: PutObject encrypts with context {aws:s3:arn: arn:aws:s3:::}; GetObject decrypts and range reads slice plaintext; CopyObject decrypts source and re-encrypts for destination; default aws/s3 key auto-provisions and persists; KMS usage recorded at /_fakecloud/kms/usage; KMS encrypt/decrypt failures abort the request.
  • SSM SecureString: PutParameter encrypts with context {PARAMETER_ARN: }; GetParameter/GetParameters/GetParametersByPath and GetParameterHistory decrypt when WithDecryption=true; default alias/aws/ssm key auto-provisions and persists; KMS usage recorded.
  • IAM PassRole trust enforcement: Lambda CreateFunction and ECS RegisterTaskDefinition/RunTask overrides reject role ARNs whose trust policy doesn’t allow the service principal (lambda.amazonaws.com, ecs-tasks.amazonaws.com), returning AWS-shaped errors.

• Migration

  • No breaking changes. Legacy non-enveloped snapshots continue to read. S3 SSE-KMS errors now surface on Put/Get/Copy. Ensure roles passed to Lambda/ECS trust the relevant service principal. Auto-provisioned aws/<service> keys persist automatically; no action needed.

^{Written for commit f669b92. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 43.77432% with 289 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-s3/src/service/mod.rs	1.88%	52 Missing ⚠️
crates/fakecloud-server/src/main.rs	0.00%	51 Missing ⚠️
crates/fakecloud-ssm/src/service/parameters.rs	61.29%	48 Missing ⚠️
crates/fakecloud-iam/src/pass_role.rs	74.50%	39 Missing ⚠️
crates/fakecloud-s3/src/service/objects.rs	45.45%	36 Missing ⚠️
crates/fakecloud-ecs/src/service.rs	0.00%	34 Missing ⚠️
crates/fakecloud-lambda/src/service.rs	16.66%	15 Missing ⚠️
crates/fakecloud-core/src/auth.rs	0.00%	10 Missing ⚠️
crates/fakecloud-ssm/src/service/mod.rs	20.00%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

1 issue found across 18 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-s3/src/service/mod.rs">

<violation number="1" location="crates/fakecloud-s3/src/service/mod.rs:133">
P1: Do not store plaintext when SSE-KMS encryption fails; return an error so SSE-KMS writes fail closed.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}