[HADOOP-16732] S3Guard to support encrypted DynamoDB table

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.3.0
• Component/s: fs/s3
• Target Version/s: 3.0.4, 3.1.4, 3.2.2, 2.10.1

Release Note

Support server-side encrypted DynamoDB table for S3Guard. Users don't need to do anything (provide any configuration or change application code) if they don't want to enable server side encryption. Existing tables and the default configuration values will keep existing behavior, which is encrypted using Amazon owned customer master key (CMK).

To enable server side encryption, users can set "fs.s3a.s3guard.ddb.table.sse.enabled" as true. This uses Amazon managed CMK "alias/aws/dynamodb". When it's enabled, a user can also specify her own custom KMS CMK with config "fs.s3a.s3guard.ddb.table.sse.cmk".

• Assignee: Mingliang Liu
• Reporter: Mingliang Liu
• Created: 28/Nov/19 11:03
• Updated: 10/Feb/20 17:28
• Resolved: 06/Feb/20 18:33

Description

S3Guard is not yet supporting encrypted DynamoDB table. We can provide an option to enable encrypted DynamoDB table so data at rest could be encrypted. S3Guard data in DynamoDB usually is not sensitive since it's the S3 namespace mirroring, but some times even this is a concern. By default it's not enabled.

Issue Links

• links to: GitHub Pull Request #1752