Not able to upload a file in encrypted s3 bucket.

Recently i tried to upload a file into my encrypted s3 bucket by using cli,but i am not able to do so.But when i tried the upload same file in unencrypted s3 bucket,it get uploaded.

Adeleke Adebowale J 전문가
한 달 전
could you Verify that you are providing the correct encryption parameters when uploading the file to the encrypted S3 bucket. If server-side encryption is enabled on the bucket, you may need to specify the appropriate encryption option (--sse, --sse-c, --sse-kms, etc.) when uploading the file.
xanthic
한 달 전
Could you provide more details for a more structured answer, which encryption are you using? SSE-S3? SSE-KMS? Which CLI command are you giving? What's the error you got? Are you specifying the encryption key in the put-object request? Does your user/role have access to KMS?
AB
한 달 전
i am using this command. aws s3 cp test.txt s3://backup/

주제

스토리지 보안, 신원 및 규정 준수

태그

아마존 심플 스토리지 서비스 AWS 자격 증명 및 액세스 관리 IAM 정책

언어

English

질문됨 한 달 전325회 조회

3개 답변

최신
최다 투표
가장 많은 댓글

Hello.

What kind of error do you get when you try to upload specifically?
If your S3 is encrypted with a KMS key, you may find the troubleshooting methods in the documentation below useful.
In the case of an S3 bucket encrypted with KMS, you will need "kms:GenerateDataKey" and "kms:Decrypt" in the IAM policy of the IAM user.
https://repost.aws/knowledge-center/s3-access-denied-error-kms

전문가

Riku_Kobayashi

답변함 한 달 전

전문가

Didier_Durand

검토됨 한 달 전

AB
한 달 전
upload failed: D:\test.txt to s3://backup/test2.txt An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:iam:: is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:ap-south-1::key/ because no identity-based policy allows the kms:GenerateDataKey action

Riku_Kobayashi 전문가

한 달 전

Thank you for sharing the error message. As stated in the error message, the "kms:GenerateDataKey" action is not allowed for IAM users, so please try attaching the following IAM policy to the IAM user.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey",
                "s3:PutObject"
            ],
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "SamplePolicy"
        }
    ]
}

From the error you provided, your IAM user doesn't have rights to the kms:GenerateDataKey

You'll need to add rights to your IAM user to use KMS api and check key policy also, that you have rights to use that exact key.

xanthic

답변함 한 달 전

전문가

AWS-User-alantam

검토됨 한 달 전

Thank you so much.Issues has been resolved.

답변함 한 달 전

Not able to upload a file in encrypted s3 bucket.

관련 콘텐츠