Adding support for SSE in the S3 storage backend. #5996
Conversation
| access_key = "abcd1234" | ||
| secret_key = "defg5678" | ||
| bucket = "my-bucket" | ||
| sse = "aws:kms" |
There was a problem hiding this comment.
It seems like there is no use case for using AES256 as the value for SSE (given that you can't also specify a key, and if you did, it'd be sitting in plaintext). Why not juse only have kms_key_id and test whether it's empty (use default) or whether it's something custom?
There was a problem hiding this comment.
Could definitely do that. It would simplify things and I'm pretty sure anyone trying to add encryption on top of what vault already does is going to use KMS, unless I add the option to specify your own key material for AES encryption. Either way, I think you're right. It makes more sense to specify a key ID and set the SSE option appropriately. AES support could be added with an alternate parameter if anyone wants it.
There was a problem hiding this comment.
Updated. Definitely cleans the code up a good bit.
|
|
|
Looks good, thanks! |
|
Nice, I see this made it into 1.0.3! |
This adds the ability to enable SSE for the S3 storage backend, including the option to use a customer managed KMS key.
Fixes #2673