Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Visual Studio - Publish AWS Serverless Application - Forced S3 Encryption policy

0

I am fairly new to AWS and have run into a problem. I am trying to publish from Visual Studio a AWS Serverless Application. The publish process asks for an S3 Bucket to upload the ZIP to, but this fails with Access Denied.

The reason for this is because we have a SCP policy that Denies S3:PutObject requests if they do not use encryption (s3:x-amz-server-side-encryption). I cannot find any information or assistance in specifying this in the publish settings, or in the Cloudformation serverless.template file.

Topics
Serverless.NET on AWS
Tags
EncryptionServerless.NET on AWS
Language
English

asked 2 years ago450 views

1 Answer
2

=>To publish an AWS Serverless Application from Visual Studio while complying with an S3 encryption policy, follow these steps:

Enable Default Encryption on S3 Bucket:

=>Go to the S3 console. Select your bucket. Go to "Properties" > "Default encryption". Enable default encryption and choose "AES-256" or "AWS-KMS". Save changes. Use the Encrypted S3 Bucket in Visual Studio:

=>When publishing from Visual Studio, specify the S3 bucket with default encryption enabled. Manual Upload with Encryption (if needed):

Upload artifacts manually with encryption: aws s3 cp path/to/your-artifact.zip s3://your-bucket-name/your-artifact.zip --sse AES256 with AWS KMS

aws s3 cp path/to/your-artifact.zip s3://your-bucket-name/your-artifact.zip --sse aws:kms --sse-kms-key-id your-kms-key-id

Update CloudFormation Template:

=>Reference the manually uploaded S3 artifact in your serverless.template or template.yaml.

EXPERT

answered 2 years ago

EXPERT

reviewed 2 years ago

EXPERT

reviewed 2 years ago

EXPERT

reviewed 2 years ago

  • FritsDonk
    2 years ago

    Thanks for the reply Mahankali. I will try this. Just to be clear, the Default Encryption is already enabled currently, but it is using "Server-side encryption with Amazon S3 managed keys (SSE-S3)"

  • FritsDonk
    2 years ago

    I have now tried to change the bucket default encryption to SSE-KMS and tried the publish from VS again. It failed with the same error message. I am not familiar with the serverless.template and how to configure it to use a manually uploaded artifacts. That said, I do not want to manually upload artifacts with each publish, I should just be able to Click on publish, and be done with it. For Info, when I remove the SCP policy to deny S3 putObject when not encrypted, everything works fine. I might just leave this policy option disabled for now.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content