AWS Transfer Family does not use S3 default encryption - SFTP - access denied

Question

Hi,
I have AWS Transfer Family configured on a private S3 backend storage with a default encryption enabled.
I'm able to download the files from S3, but uploading files throws an access denied error.
We have precisely the same problem for buckets with default encryption set to either SSE-S3, SSE-KMS (s3 alias) or CMK.
The role policy associated with a Transfer Family user grants full access to s3 and the CMK key as well.
To verify the policy associated with the role, I assumed a role with the same policy and executed 'aws s3 cp' command, and this completes successfully, as long as I provide '--sse' server site encryption arguments.
Could it be that AWS Transfer Family does not pass along correct server site encryption information while uploading files?

Regards,
Chris

rePost-User-3326948 · Accepted Answer

OK, it turned out that we have an SCP policy which enforces us to include the x-amz-server-side-encryption header for each s3:PutObject. Since it is not what AWS Transfer family does, we're getting that access denied error. So the solution is to exclude Transfer Family service from that SCP.

Sachin · Answer

have you checked the server logs ?
and if you saw below error then You must specify additional permissions in your policy to grant the required AWS Key Management Service (AWS KMS) permissions. For details, you can check below link

https://docs.aws.amazon.com/transfer/latest/userguide/encryption-at-rest.html

ERROR Message="Access denied" Operation=CLOSE Path=/bucket/user/test.txt BytesIn=13
ERROR Message="Access denied"

Sachin · Answer

Make sure you gave right access to user on key used in S3.

kentrad · Answer

Could it be the [Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html) does not allow the role?

```
Unless the key policy explicitly allows it, you cannot use IAM policies to allow access to a KMS key. Without permission from the key policy, IAM policies that allow permissions have no effect. 
```

MK · Answer

I have the same issue with uploading files into SFTP server to S3 bucket getting "Access Denied" error.
I can already download existing files successfully from SFTP server which are encrypted in S3 bucket, so the KMS key access works.
Also it works with the same configuration in our old AWS account (all KMS permissions granted to IAM role and within KMS key policy). Probably in this old AWS account there were no SCP policies enabled.

Our problem might be caused by our SCP policy as well that enforces x-amz-server-side-encryption header

We also can't upload new files to S3 bucket using AWS console, it only works if we set the hidden option "Properties" -> "Server-side encryption" -> "Specify an encryption key" -> "Use bucket settings for default encryption".
Similar when using AWS CLI we have to set the additional params or otherwise we get Access Denied as well:
aws s3 cp [...] --server-side-encryption aws:kms
aws s3api put-object [...] --sse aws:kms

AWS Transfer Family does not use S3 default encryption - SFTP - access denied

Relevant content