Amazon S3 Specific One Zone, a high-performance, single-Availability Zone (AZ) S3 storage class, now helps server-side encryption with AWS Key Administration Service (KMS) keys (SSE-KMS). S3 Specific One Zone already encrypts all objects saved in S3 listing buckets with Amazon S3 managed keys (SSE-S3) by default. Beginning at the moment, you should utilize AWS KMS buyer managed keys to encrypt information at relaxation, with no influence on efficiency. This new encryption functionality provides you a further choice to fulfill compliance and regulatory necessities when utilizing S3 Specific One Zone, which is designed to ship constant single-digit millisecond information entry to your most steadily accessed information and latency-sensitive purposes.
S3 listing buckets assist you to specify just one buyer managed key per bucket for SSE-KMS encryption. As soon as the client managed secret is added, you can not edit it to make use of a brand new key. Then again, with S3 basic objective buckets, you should utilize a number of KMS keys both by altering the default encryption configuration of the bucket or throughout S3 PUT requests. When utilizing SSE-KMS with S3 Specific One Zone, S3 Bucket Keys are at all times enabled. S3 Bucket Keys are free and scale back the variety of requests to AWS KMS by as much as 99%, optimizing each efficiency and prices.
Utilizing SSE-KMS with Amazon S3 Specific One Zone
To indicate you this new functionality in motion, I first create an S3 listing bucket within the Amazon S3 console following the steps to create a S3 listing bucket and use apne1-az4 because the Availability Zone. In Base identify, I enter s3express-kms after which a suffix that features the Availability Zone ID is mechanically added to create the ultimate identify. Then, I choose the checkbox to acknowledge that Information is saved in a single Availability Zone adopted by Create bucket.
Now we’ll stroll by utilizing the AWS Command Line Interface (AWS CLI) to arrange encryption on the bucket we simply created.
To make use of SSE-KMS with S3 Specific One Zone by way of the AWS CLI, you want an AWS Identification and Entry Administration (IAM) consumer or position with the next coverage . This coverage permits the CreateSession API operation, which is important to efficiently add and obtain encrypted information to and out of your S3 listing bucket.
I’ll use PutBucketEncryption API to set my default bucket encryption to SSE-KMS. Right here is an instance of the AWS CLI:
aws s3api put-bucket-encryption
--bucket s3express-kms--apne1-az4--x-s3
--server-side-encryption-configuration
'{"Guidelines": [{"ApplyServerSideEncryptionByDefault":
{"SSEAlgorithm": "aws:kms",
"KMSMasterKeyID": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"BucketKeyEnabled":true}]}'Any new object I add to this S3 listing bucket shall be mechanically encrypted utilizing my AWS KMS key. With the PutObject command, I add a brand new file named confidential-doc.txt to my S3 listing bucket.
As a hit of the earlier command I obtain the next output:
Checking the item’s properties with HeadObject command, I see that it’s encrypted utilizing SSE-KMS with the important thing that I created earlier than:
I get the next output:
I obtain the encrypted object with GetObject:
As my session has the mandatory permissions, the item is downloaded and decrypted mechanically.
For this second check, I exploit a unique IAM consumer with a coverage that isn’t granted the mandatory KMS key permissions to obtain the item. This try fails with an AccessDenied error, demonstrating that the SSE-KMS encryption is functioning as supposed.
This demonstration exhibits how SSE-KMS works seamlessly with S3 Specific One Zone, offering a further layer of safety whereas sustaining ease of use for licensed customers.
Issues to know
Getting began – You may allow SSE-KMS for S3 Specific One Zone utilizing the AWS CLI or AWS SDKs. Set the default encryption configuration of your S3 listing bucket to SSE-KMS and specify your AWS KMS key. Keep in mind, you’ll be able to solely use one buyer managed key per S3 listing bucket for its lifetime.
Areas – S3 Specific One Zone help for SSE-KMS utilizing buyer managed keys is accessible in all AWS Areas the place S3 Specific One Zone is at present accessible.
Efficiency – Utilizing SSE-KMS with S3 Specific One Zone doesn’t influence request latency. You’ll proceed to expertise the identical single-digit millisecond information entry.
Pricing – You pay AWS KMS prices to generate and retrieve information keys used for encryption and decryption. Go to the AWS KMS pricing web page for extra particulars. As well as, when utilizing SSE-KMS with S3 Specific One Zone, S3 Bucket Keys are enabled by default for all information airplane operations apart from CopyObject and UploadPartCopy, and might’t be disabled. This reduces the variety of requests to AWS KMS by as much as 99%, optimizing each efficiency and prices.
AWS CloudTrail integration – You may audit SSE-KMS actions on S3 Specific One Zone objects utilizing AWS CloudTrail. Be taught extra about that in my earlier weblog publish.
– Eli.
Up to date on September 19, 2024 – We up to date the CLI instance to configure default encryption for an current bucket as a substitute of the console.
