[NIFI-4256] Add support for all AWS S3 Encryption Options

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2.0
• Fix Version/s: 1.10.0
• Component/s: Core Framework
• Labels: aws aws-s3 security
• Assignee: Troy Melhase
• Reporter: Franco
• Created: 02/Aug/17 06:21
• Updated: 27/May/21 00:13
• Resolved: 13/Aug/19 19:29

Description

NiFi currently only supports SSE-S3 encryption (AES256).

Support needs to be added for:

• SSE-S3
• SSE-KMS
• SSE-C
• CSE-KMS CMK
• CSE-Master Key

With all of the appropriate configuration options and such that SSE is available only for PutS3Object whilst CSE is available also for FetchS3Object.

Given that this will add another 20 or so UI properties the intention is to split it into a Client Side Encryption Service and Server Side Encryption Service. This will allow users to reuse "encryption" across different workflows.

Existing flows using the Server Side Encryption option will still work as is but will be overridden if a service is added.

Issue Links

• duplicates: NIFI-3645 Add aws:kms, sse-c, sse-c-key, and sse-kms-key-id capability to server side encryption in the PutS3Object processor.
• is related to: NIFI-3645 Add aws:kms, sse-c, sse-c-key, and sse-kms-key-id capability to server side encryption in the PutS3Object processor.
• relates to: NIFI-1769 Add support for SSE-KMS and S3 Signature Version 4 Authentication AWS
• links to: GitHub Pull Request #2066
• links to: GitHub Pull Request #2066
• links to: GitHub Pull Request #2248
• links to: GitHub Pull Request #2291
• links to: GitHub Pull Request #3574