Server Side Encryption with KMS managed key requires HTTP header x-amz-server-side-encryption

[cory-weiner]

I am trying to setup server side encryption on my django app for file uploads. I am using s3Boto3Storage. I can't find clear documentation on how to implement server side encryption, and when trying to upload my file, I get the following error:

An error occurred (InvalidArgument) when calling the PutObject operation: Server Side Encryption with KMS managed key requires HTTP header x-amz-server-side-encryption : aws:kms

Here is what my settings look like:

AWS_ACCESS_KEY_ID = 'XXXX'
AWS_SECRET_ACCESS_KEY = 'XXXX'
AWS_STORAGE_BUCKET_NAME = 'tickets'
AWS_S3_ENDPOINT_URL = 'https://sfo2.digitaloceanspaces.com'
AWS_S3_FILE_OVERWRITE = False
AWS_S3_OBJECT_PARAMETERS = {
    'CacheControl': 'max-age=86400',
}
AWS_LOCATION = ''
AWS_DEFAULT_ACL = None
AWS_S3_ENCRYPTION = True

STATIC_URL = 'https://%s/%s/' % (AWS_S3_ENDPOINT_URL, AWS_LOCATION)
STATICFILES_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'

[cory-weiner]

I did manage to figure out saving the file to S3 (digitalocean) by adding some additional params:

AWS_S3_OBJECT_PARAMETERS = {
    'CacheControl': 'max-age=86400',
    "SSECustomerAlgorithm":'AES256',
    "SSECustomerKey":'at1TMx82nEy7SoAK8jHYanMQDVZMSLayXaaUvTc6CP0=',
    "SSECustomerKeyMD5":'LWkBoT3psNdTYez70TVHUQ==',
}

However, when I try to access the file using .open() I get the following:

botocore.exceptions.ClientError: An error occurred (400) when calling the HeadObject operation: Bad Request

[denisvlr]

I ran into the same issue (writing works, reading does not). I'm on AWS so I don't think it's specific to Digital Ocean. Did you find a solution @cory-weiner?

If I use boto3 directly it works:

import boto3
s3 = boto3.client('s3')
s3.get_object(Bucket=BUCKET,
    Key=path,
    SSECustomerKey=secret_key,
    SSECustomerAlgorithm='AES256')

So the issue seems to be in django-storages

[jschneier]

I think this is a dupe of #879.

[jschneier]

Dupe #879