amazon server side encryption with post request

Question

I'm trying to use and enforce amazon s3 server side encryption. I followed their documentation and I've created the following bucket policy:

{
   "Version":"2012-10-17",
    "Id":"PutObjPolicy",
    "Statement":[{
        "Sid":"DenyUnEncryptedObjectUploads",
        "Effect":"Deny",
        "Principal":"*",
        "Action":"s3:PutObject",
        "Resource":"arn:aws:s3:::YourBucket/*",
        "Condition":{
           "StringNotEquals":{
              "s3:x-amz-server-side-encryption":"AES256"
           }
        }
     }
  ]
}

I'm using python boto package, and when I'm adding x-amz-server-side-encryption header its works like a charm.

The problem is that there are several places in the application, that are using a post request from an HTML form to upload files to s3.

I've managed to add the x-amz-server-side-encryption header and the files are uploaded. However, when checking in the amazon backend console I can see that those files are not encrypted.

Does anybody have an idea what I'm doing wrong? I also tried to pass the x-amz-server-side-encryption as a form field but it doesn't help. The interesting part is that when I remove the x-amz-server-side-encryption header, the requests are failing with "access deny" reason.

I would suggest you temporarily remove the bucket policy and place the x-amz-server-side-encryption=AES256 in the form, and {"x-amz-server-side-encryption": "AES256"}, in the form policy document, nothing in the headers, and see what you get. Examine also the response headers, as they should include a mention of the encryption. — Michael - sqlbot

Anatoly Libman Anatoly Libman · Accepted Answer · 2015-07-27T11:48:33

The solution was to add the x-amz-server-side-encryption to the policy object.

For example:

POLICY = """{'expiration': '2016-01-01T00:00:00Z',
'conditions': [
   {'bucket': 'my_bucket'},
   ['starts-with', '$key', '%s/'],
   {'acl': 'public-read'},
   ['starts-with', '$Content-Type', ''],
   ['content-length-range', 0, 314572800],
  {'x-amz-server-side-encryption': 'AES256'}
]
}"""

And to add 'x-amz-server-side-encryption' form field with "AES256" value. There is no need to add it as a header in this case

amazon server side encryption with post request

1 Answers