AWS: Support S3 DSSE-KMS encryption #8370
Conversation
aws/src/test/java/org/apache/iceberg/aws/s3/signer/TestS3SignRequestParser.java
Outdated
Show resolved
Hide resolved
aws/src/main/java/org/apache/iceberg/aws/s3/S3FileIOProperties.java
Outdated
Show resolved
Hide resolved
|
I think it would be better to split this into 2 PRs (one that only updates the AWS SDK version) |
| * If S3 encryption type is SSE-KMS, input is a KMS Key ID or ARN. In case this property is not | ||
| * set, default key "aws/s3" is used. If encryption type is SSE-C, input is a custom base-64 | ||
| * AES256 symmetric key. | ||
| * If S3 encryption type is SSE-KMS or DSSE-KMS, input is a KMS Key ID or ARN. In case this |
There was a problem hiding this comment.
Sorry, what does that exactly mean?
There was a problem hiding this comment.
I see what i meant here was the comment describe an if else structure which makes it a bit hard to follow was wondering if we can re-write this comment in such as way that it's easy for a user to understand / read it.
This is just a nit and not a blocking comment, as you are just adding a disjunstion to an already existing if branch. please feel free to ignore.
|
Thank you @nastra and @singhpk234 for your review. Let me create a separate PR to upgrade AWS SDK version. |
|
Opened #8379 to upgrade AWS SDK version |
7aa66ba to
11d6daa
Compare
aws/src/test/java/org/apache/iceberg/aws/s3/signer/TestS3SignResponseParser.java
Outdated
Show resolved
Hide resolved
| * <p>For more details: | ||
| * https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingDSSEncryption.html | ||
| */ | ||
| public static final String DSSE_TYPE_KMS = "kms.dsse"; |
There was a problem hiding this comment.
The naming kms.dsse implies that DSSE will exist as a property namespace under KMS. Are there any other configurations which would actually go under this namespace? If not should we just call it dsse-kms?
There was a problem hiding this comment.
No, there isn't any other configuration go under this namespace. Changed to dsse-kms.
amogh-jahagirdar
left a comment
There was a problem hiding this comment.
LGTM, thanks @aajisaka ! Will wait for @singhpk234 @jackye1995 to take a look before merging
singhpk234
left a comment
There was a problem hiding this comment.
LGTM ! Thanks @aajisaka !
|
From my side, is there something do to make it forward? |
This commit updates AWS SDK v2 version to 2.20.131.
8e8cf40 to
2598066
Compare
|
Rebased for the latest main branch |
|
I think this patch is ready to merge:
|
|
Was waiting for @nastra , but I agree this is ready to be merged, I will go ahead to do that, thanks for the contribution! |
|
Thanks! |
This PR is to support S3 Dual-layer Server Side Encryption (DSSE) for Iceberg tables.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingDSSEncryption.html