Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

S3 provider SSE-C not working since parameters (key) is not passed to Boto3 #879

Closed
greenstatic opened this issue Apr 28, 2020 · 0 comments · Fixed by #1286
Closed

S3 provider SSE-C not working since parameters (key) is not passed to Boto3 #879

greenstatic opened this issue Apr 28, 2020 · 0 comments · Fixed by #1286

Comments

@greenstatic
Copy link

When we enable SSE-C for the S3 provider using the following settings:

AWS_S3_OBJECT_PARAMETERS = {
    "SSECustomerAlgorithm": "AES256",
    "SSECustomerKey": "<redacted key>",
    "SSECustomerKeyMD5": "<redacted md5 key>"
}

We can successfully save a file to S3 (Minio) but when we try to retrieve it, we get a generic error.
The file however is normally accessible using the aws-cli when supplied with the correct encryption keys.
Meaning django-storages handles saving files using encryption just fine, but doesn't read them correctly.

I dived into the code and found 2 issues when reading files from S3.

  1. The first HEAD request (https://github.com/jschneier/django-storages/blob/master/storages/backends/s3boto3.py#L74) does not contain the necessary parameters (i.e. AWS_S3_OBJECT_PARAMETERS that contain the necessary headers).
    Adding the encryption keys to the HEAD request is required as per AWS S3 documentation:

If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you retrieve the metadata from the object, you must use the following headers:

  • x-amz-server-side​-encryption​-customer-algorithm
  • x-amz-server-side​-encryption​-customer-key
  • x-amz-server-side​-encryption​-customer-key-MD5
  1. Once 1. is fixed, we still get an error because when we fetch the contents of the file (https://github.com/jschneier/django-storages/blob/master/storages/backends/s3boto3.py#L100), we do so again without passing params (AWS_S3_OBJECT_PARAMETERS) to boto3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant