I am trying to upload a file to a cross account s3 bucket which has enabled kms key. below is the code:
InstanceProfileCredentialsProvider iamCredentials = new InstanceProfileCredentialsProvider();
AmazonS3 s3client = new AmazonS3Client(iamCredentials);
FileInputStream stream = new FileInputStream("/home/tomcat/Test.txt");
ObjectMetadata objectMetadata = new ObjectMetadata();
int bytesAvailable = stream.available();
byte[] fileBytes = new byte[bytesAvailable];
Long contentLength = Long.valueOf(fileBytes.length);
objectMetadata.setContentLength(contentLength);
objectMetadata.setSSEAlgorithm(SSEAlgorithm.KMS.getAlgorithm());
PutObjectRequest putObjectRequest = new PutObjectRequest(bucketName,"/Test/Test.txt",stream, objectMetadata).withCannedAcl(CannedAccessControlList.BucketOwnerFullControl);
putObjectRequest.withSSEAwsKeyManagementParams(new SSEAwsKeyManagementParams(kmsKeyId));
s3client.putObject(putObjectRequest);
Here I am using iam role to connect to external s3 bucket. iam policy:
arn:aws:iam::xxxxxxxxxxxxxx:role/role1 (xxxxxxxxxxxxxx is the local account id)
----------------------------------------
role1_kms_access_policy
-----------------------
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"kms:EnableKeyRotation",
"kms:EnableKey",
"kms:Decrypt",
"kms:ListKeyPolicies",
"kms:UntagResource",
"kms:ListRetirableGrants",
"kms:GetKeyPolicy",
"kms:GenerateDataKeyWithoutPlaintext",
"kms:ListResourceTags",
"kms:ReEncryptFrom",
"kms:ListGrants",
"kms:GetParametersForImport",
"kms:DescribeCustomKeyStores",
"kms:ListKeys",
"kms:TagResource",
"kms:GetKeyRotationStatus",
"kms:Encrypt",
"kms:ScheduleKeyDeletion",
"kms:ListAliases",
"kms:GenerateDataKey",
"kms:ReEncryptTo",
"kms:DescribeKey",
"kms:ConnectCustomKeyStore"
],
"Resource": "*"
}
]
}
external bucket kms policy:
{
"Effect": "Allow",
"Principal": {
enter code here
"AWS": "arn:aws:iam::xxxxxxxxxxxxxx:role/role1"
},
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Resource": "*"
}
When running the code if i pass kms key of external bucket to variable kmsKeyId then exception is occurring:
com.amazonaws.services.s3.model.AmazonS3Exception: Key 'arn:aws:kms:us-east-1:xxxxxxxxxxxxxx:key/{kmsKeyId}' (here kmskey id is the value of passed km key) does not exist (Service: Amazon S3; Status Code: 400; Error Code: KMS.NotFoundException; Request ID: BQ3VWZK5VC88GXV1; S3 Extended Request ID: csDK/X8MjPHNuV4NrziYoUPBbqZG+Jp269IgBXFTnPQYxjJBgLailWtY7F0JjDLsNyHNO60xeVE=), S3 Extended Request ID: csDK/X8MjPHNuV4NrziYoUPBbqZG+Jp269IgBXFTnPQYxjJBgLailWtY7F0JjDLsNyHNO60xeVE=
And if we pass whole arn to kmskeyId then it shows access denied exception.