aws-sdk-s3 1.45.0 → 1.143.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (128) hide show
  1. checksums.yaml +5 -5
  2. data/CHANGELOG.md +1106 -0
  3. data/LICENSE.txt +202 -0
  4. data/VERSION +1 -0
  5. data/lib/aws-sdk-s3/bucket.rb +784 -98
  6. data/lib/aws-sdk-s3/bucket_acl.rb +64 -18
  7. data/lib/aws-sdk-s3/bucket_cors.rb +79 -18
  8. data/lib/aws-sdk-s3/bucket_lifecycle.rb +66 -20
  9. data/lib/aws-sdk-s3/bucket_lifecycle_configuration.rb +68 -20
  10. data/lib/aws-sdk-s3/bucket_logging.rb +68 -16
  11. data/lib/aws-sdk-s3/bucket_notification.rb +52 -20
  12. data/lib/aws-sdk-s3/bucket_policy.rb +107 -17
  13. data/lib/aws-sdk-s3/bucket_region_cache.rb +2 -0
  14. data/lib/aws-sdk-s3/bucket_request_payment.rb +60 -15
  15. data/lib/aws-sdk-s3/bucket_tagging.rb +71 -18
  16. data/lib/aws-sdk-s3/bucket_versioning.rb +133 -17
  17. data/lib/aws-sdk-s3/bucket_website.rb +78 -21
  18. data/lib/aws-sdk-s3/client.rb +12610 -902
  19. data/lib/aws-sdk-s3/client_api.rb +1086 -191
  20. data/lib/aws-sdk-s3/customizations/bucket.rb +56 -37
  21. data/lib/aws-sdk-s3/customizations/errors.rb +27 -0
  22. data/lib/aws-sdk-s3/customizations/multipart_upload.rb +2 -0
  23. data/lib/aws-sdk-s3/customizations/object.rb +282 -68
  24. data/lib/aws-sdk-s3/customizations/object_summary.rb +5 -0
  25. data/lib/aws-sdk-s3/customizations/types/list_object_versions_output.rb +2 -0
  26. data/lib/aws-sdk-s3/customizations/types/permanent_redirect.rb +26 -0
  27. data/lib/aws-sdk-s3/customizations.rb +11 -1
  28. data/lib/aws-sdk-s3/encryption/client.rb +28 -7
  29. data/lib/aws-sdk-s3/encryption/decrypt_handler.rb +71 -29
  30. data/lib/aws-sdk-s3/encryption/default_cipher_provider.rb +43 -5
  31. data/lib/aws-sdk-s3/encryption/default_key_provider.rb +2 -0
  32. data/lib/aws-sdk-s3/encryption/encrypt_handler.rb +13 -2
  33. data/lib/aws-sdk-s3/encryption/errors.rb +2 -0
  34. data/lib/aws-sdk-s3/encryption/io_auth_decrypter.rb +2 -0
  35. data/lib/aws-sdk-s3/encryption/io_decrypter.rb +11 -3
  36. data/lib/aws-sdk-s3/encryption/io_encrypter.rb +2 -0
  37. data/lib/aws-sdk-s3/encryption/key_provider.rb +2 -0
  38. data/lib/aws-sdk-s3/encryption/kms_cipher_provider.rb +46 -11
  39. data/lib/aws-sdk-s3/encryption/materials.rb +8 -6
  40. data/lib/aws-sdk-s3/encryption/utils.rb +25 -0
  41. data/lib/aws-sdk-s3/encryption.rb +4 -0
  42. data/lib/aws-sdk-s3/encryptionV2/client.rb +570 -0
  43. data/lib/aws-sdk-s3/encryptionV2/decrypt_handler.rb +223 -0
  44. data/lib/aws-sdk-s3/encryptionV2/default_cipher_provider.rb +170 -0
  45. data/lib/aws-sdk-s3/encryptionV2/default_key_provider.rb +40 -0
  46. data/lib/aws-sdk-s3/encryptionV2/encrypt_handler.rb +65 -0
  47. data/lib/aws-sdk-s3/encryptionV2/errors.rb +37 -0
  48. data/lib/aws-sdk-s3/encryptionV2/io_auth_decrypter.rb +58 -0
  49. data/lib/aws-sdk-s3/encryptionV2/io_decrypter.rb +37 -0
  50. data/lib/aws-sdk-s3/encryptionV2/io_encrypter.rb +73 -0
  51. data/lib/aws-sdk-s3/encryptionV2/key_provider.rb +31 -0
  52. data/lib/aws-sdk-s3/encryptionV2/kms_cipher_provider.rb +173 -0
  53. data/lib/aws-sdk-s3/encryptionV2/materials.rb +60 -0
  54. data/lib/aws-sdk-s3/encryptionV2/utils.rb +103 -0
  55. data/lib/aws-sdk-s3/encryption_v2.rb +23 -0
  56. data/lib/aws-sdk-s3/endpoint_parameters.rb +178 -0
  57. data/lib/aws-sdk-s3/endpoint_provider.rb +591 -0
  58. data/lib/aws-sdk-s3/endpoints.rb +2590 -0
  59. data/lib/aws-sdk-s3/errors.rb +123 -1
  60. data/lib/aws-sdk-s3/event_streams.rb +8 -1
  61. data/lib/aws-sdk-s3/express_credentials.rb +55 -0
  62. data/lib/aws-sdk-s3/express_credentials_cache.rb +30 -0
  63. data/lib/aws-sdk-s3/express_credentials_provider.rb +36 -0
  64. data/lib/aws-sdk-s3/file_downloader.rb +176 -44
  65. data/lib/aws-sdk-s3/file_part.rb +11 -6
  66. data/lib/aws-sdk-s3/file_uploader.rb +39 -18
  67. data/lib/aws-sdk-s3/legacy_signer.rb +17 -25
  68. data/lib/aws-sdk-s3/multipart_file_uploader.rb +78 -20
  69. data/lib/aws-sdk-s3/multipart_stream_uploader.rb +56 -18
  70. data/lib/aws-sdk-s3/multipart_upload.rb +242 -32
  71. data/lib/aws-sdk-s3/multipart_upload_error.rb +2 -0
  72. data/lib/aws-sdk-s3/multipart_upload_part.rb +367 -45
  73. data/lib/aws-sdk-s3/object.rb +2191 -227
  74. data/lib/aws-sdk-s3/object_acl.rb +103 -25
  75. data/lib/aws-sdk-s3/object_copier.rb +9 -5
  76. data/lib/aws-sdk-s3/object_multipart_copier.rb +43 -19
  77. data/lib/aws-sdk-s3/object_summary.rb +1811 -208
  78. data/lib/aws-sdk-s3/object_version.rb +452 -80
  79. data/lib/aws-sdk-s3/plugins/accelerate.rb +17 -64
  80. data/lib/aws-sdk-s3/plugins/arn.rb +70 -0
  81. data/lib/aws-sdk-s3/plugins/bucket_dns.rb +7 -43
  82. data/lib/aws-sdk-s3/plugins/bucket_name_restrictions.rb +20 -3
  83. data/lib/aws-sdk-s3/plugins/dualstack.rb +7 -50
  84. data/lib/aws-sdk-s3/plugins/endpoints.rb +274 -0
  85. data/lib/aws-sdk-s3/plugins/expect_100_continue.rb +5 -4
  86. data/lib/aws-sdk-s3/plugins/express_session_auth.rb +91 -0
  87. data/lib/aws-sdk-s3/plugins/get_bucket_location_fix.rb +3 -1
  88. data/lib/aws-sdk-s3/plugins/http_200_errors.rb +11 -3
  89. data/lib/aws-sdk-s3/plugins/iad_regional_endpoint.rb +44 -0
  90. data/lib/aws-sdk-s3/plugins/location_constraint.rb +5 -1
  91. data/lib/aws-sdk-s3/plugins/md5s.rb +35 -30
  92. data/lib/aws-sdk-s3/plugins/redirects.rb +2 -0
  93. data/lib/aws-sdk-s3/plugins/s3_host_id.rb +2 -0
  94. data/lib/aws-sdk-s3/plugins/s3_signer.rb +56 -92
  95. data/lib/aws-sdk-s3/plugins/skip_whole_multipart_get_checksums.rb +31 -0
  96. data/lib/aws-sdk-s3/plugins/sse_cpk.rb +3 -1
  97. data/lib/aws-sdk-s3/plugins/streaming_retry.rb +139 -0
  98. data/lib/aws-sdk-s3/plugins/url_encoded_keys.rb +2 -0
  99. data/lib/aws-sdk-s3/presigned_post.rb +160 -99
  100. data/lib/aws-sdk-s3/presigner.rb +171 -80
  101. data/lib/aws-sdk-s3/resource.rb +120 -8
  102. data/lib/aws-sdk-s3/types.rb +11353 -4225
  103. data/lib/aws-sdk-s3/waiters.rb +67 -1
  104. data/lib/aws-sdk-s3.rb +16 -6
  105. data/sig/bucket.rbs +212 -0
  106. data/sig/bucket_acl.rbs +78 -0
  107. data/sig/bucket_cors.rbs +69 -0
  108. data/sig/bucket_lifecycle.rbs +88 -0
  109. data/sig/bucket_lifecycle_configuration.rbs +111 -0
  110. data/sig/bucket_logging.rbs +76 -0
  111. data/sig/bucket_notification.rbs +114 -0
  112. data/sig/bucket_policy.rbs +59 -0
  113. data/sig/bucket_request_payment.rbs +54 -0
  114. data/sig/bucket_tagging.rbs +65 -0
  115. data/sig/bucket_versioning.rbs +77 -0
  116. data/sig/bucket_website.rbs +93 -0
  117. data/sig/client.rbs +2360 -0
  118. data/sig/errors.rbs +34 -0
  119. data/sig/multipart_upload.rbs +110 -0
  120. data/sig/multipart_upload_part.rbs +105 -0
  121. data/sig/object.rbs +436 -0
  122. data/sig/object_acl.rbs +86 -0
  123. data/sig/object_summary.rbs +334 -0
  124. data/sig/object_version.rbs +131 -0
  125. data/sig/resource.rbs +124 -0
  126. data/sig/types.rbs +2562 -0
  127. data/sig/waiters.rbs +83 -0
  128. metadata +68 -15
@@ -0,0 +1,73 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'stringio'
4
+ require 'tempfile'
5
+
6
+ module Aws
7
+ module S3
8
+ module EncryptionV2
9
+
10
+ # Provides an IO wrapper encrypting a stream of data.
11
+ # @api private
12
+ class IOEncrypter
13
+
14
+ # @api private
15
+ ONE_MEGABYTE = 1024 * 1024
16
+
17
+ def initialize(cipher, io)
18
+ @encrypted = io.size <= ONE_MEGABYTE ?
19
+ encrypt_to_stringio(cipher, io.read) :
20
+ encrypt_to_tempfile(cipher, io)
21
+ @size = @encrypted.size
22
+ end
23
+
24
+ # @return [Integer]
25
+ attr_reader :size
26
+
27
+ def read(bytes = nil, output_buffer = nil)
28
+ if @encrypted.is_a?(Tempfile) && @encrypted.closed?
29
+ @encrypted.open
30
+ @encrypted.binmode
31
+ end
32
+ @encrypted.read(bytes, output_buffer)
33
+ end
34
+
35
+ def rewind
36
+ @encrypted.rewind
37
+ end
38
+
39
+ # @api private
40
+ def close
41
+ @encrypted.close if @encrypted.is_a?(Tempfile)
42
+ end
43
+
44
+ private
45
+
46
+ def encrypt_to_stringio(cipher, plain_text)
47
+ if plain_text.empty?
48
+ StringIO.new(cipher.final + cipher.auth_tag)
49
+ else
50
+ StringIO.new(cipher.update(plain_text) + cipher.final + cipher.auth_tag)
51
+ end
52
+ end
53
+
54
+ def encrypt_to_tempfile(cipher, io)
55
+ encrypted = Tempfile.new(self.object_id.to_s)
56
+ encrypted.binmode
57
+ while chunk = io.read(ONE_MEGABYTE, read_buffer ||= String.new)
58
+ if cipher.method(:update).arity == 1
59
+ encrypted.write(cipher.update(chunk))
60
+ else
61
+ encrypted.write(cipher.update(chunk, cipher_buffer ||= String.new))
62
+ end
63
+ end
64
+ encrypted.write(cipher.final)
65
+ encrypted.write(cipher.auth_tag)
66
+ encrypted.rewind
67
+ encrypted
68
+ end
69
+
70
+ end
71
+ end
72
+ end
73
+ end
@@ -0,0 +1,31 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Aws
4
+ module S3
5
+ module EncryptionV2
6
+
7
+ # This module defines the interface required for a {Client#key_provider}.
8
+ # A key provider is any object that:
9
+ #
10
+ # * Responds to {#encryption_materials} with an {Materials} object.
11
+ #
12
+ # * Responds to {#key_for}, receiving a JSON document String,
13
+ # returning an encryption key. The returned encryption key
14
+ # must be one of:
15
+ #
16
+ # * `OpenSSL::PKey::RSA` - for asymmetric encryption
17
+ # * `String` - 32, 24, or 16 bytes long, for symmetric encryption
18
+ #
19
+ module KeyProvider
20
+
21
+ # @return [Materials]
22
+ def encryption_materials; end
23
+
24
+ # @param [String<JSON>] materials_description
25
+ # @return [OpenSSL::PKey::RSA, String] encryption_key
26
+ def key_for(materials_description); end
27
+
28
+ end
29
+ end
30
+ end
31
+ end
@@ -0,0 +1,173 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'base64'
4
+
5
+ module Aws
6
+ module S3
7
+ module EncryptionV2
8
+ # @api private
9
+ class KmsCipherProvider
10
+
11
+ def initialize(options = {})
12
+ @kms_key_id = validate_kms_key(options[:kms_key_id])
13
+ @kms_client = options[:kms_client]
14
+ @key_wrap_schema = validate_key_wrap(
15
+ options[:key_wrap_schema]
16
+ )
17
+ @content_encryption_schema = validate_cek(
18
+ options[:content_encryption_schema]
19
+ )
20
+ end
21
+
22
+ # @return [Array<Hash,Cipher>] Creates and returns a new encryption
23
+ # envelope and encryption cipher.
24
+ def encryption_cipher(options = {})
25
+ validate_key_for_encryption
26
+ encryption_context = build_encryption_context(@content_encryption_schema, options)
27
+ key_data = Aws::Plugins::UserAgent.feature('S3CryptoV2') do
28
+ @kms_client.generate_data_key(
29
+ key_id: @kms_key_id,
30
+ encryption_context: encryption_context,
31
+ key_spec: 'AES_256'
32
+ )
33
+ end
34
+ cipher = Utils.aes_encryption_cipher(:GCM)
35
+ cipher.key = key_data.plaintext
36
+ envelope = {
37
+ 'x-amz-key-v2' => encode64(key_data.ciphertext_blob),
38
+ 'x-amz-iv' => encode64(cipher.iv = cipher.random_iv),
39
+ 'x-amz-cek-alg' => @content_encryption_schema,
40
+ 'x-amz-tag-len' => (AES_GCM_TAG_LEN_BYTES * 8).to_s,
41
+ 'x-amz-wrap-alg' => @key_wrap_schema,
42
+ 'x-amz-matdesc' => Json.dump(encryption_context)
43
+ }
44
+ cipher.auth_data = '' # auth_data must be set after key and iv
45
+ [envelope, cipher]
46
+ end
47
+
48
+ # @return [Cipher] Given an encryption envelope, returns a
49
+ # decryption cipher.
50
+ def decryption_cipher(envelope, options = {})
51
+ encryption_context = Json.load(envelope['x-amz-matdesc'])
52
+ cek_alg = envelope['x-amz-cek-alg']
53
+
54
+ case envelope['x-amz-wrap-alg']
55
+ when 'kms'
56
+ unless options[:security_profile] == :v2_and_legacy
57
+ raise Errors::LegacyDecryptionError
58
+ end
59
+ when 'kms+context'
60
+ if cek_alg != encryption_context['aws:x-amz-cek-alg']
61
+ raise Errors::CEKAlgMismatchError
62
+ end
63
+
64
+ if encryption_context != build_encryption_context(cek_alg, options)
65
+ raise Errors::DecryptionError, 'Value of encryption context from'\
66
+ ' envelope does not match the provided encryption context'
67
+ end
68
+ when 'AES/GCM'
69
+ raise ArgumentError, 'Key mismatch - Client is configured' \
70
+ ' with a KMS key and the x-amz-wrap-alg is AES/GCM.'
71
+ when 'RSA-OAEP-SHA1'
72
+ raise ArgumentError, 'Key mismatch - Client is configured' \
73
+ ' with a KMS key and the x-amz-wrap-alg is RSA-OAEP-SHA1.'
74
+ else
75
+ raise ArgumentError, 'Unsupported wrap-alg: ' \
76
+ "#{envelope['x-amz-wrap-alg']}"
77
+ end
78
+
79
+ any_cmk_mode = false || options[:kms_allow_decrypt_with_any_cmk]
80
+ decrypt_options = {
81
+ ciphertext_blob: decode64(envelope['x-amz-key-v2']),
82
+ encryption_context: encryption_context
83
+ }
84
+ unless any_cmk_mode
85
+ decrypt_options[:key_id] = @kms_key_id
86
+ end
87
+
88
+ key = Aws::Plugins::UserAgent.feature('S3CryptoV2') do
89
+ @kms_client.decrypt(decrypt_options).plaintext
90
+ end
91
+ iv = decode64(envelope['x-amz-iv'])
92
+ block_mode =
93
+ case cek_alg
94
+ when 'AES/CBC/PKCS5Padding'
95
+ :CBC
96
+ when 'AES/CBC/PKCS7Padding'
97
+ :CBC
98
+ when 'AES/GCM/NoPadding'
99
+ :GCM
100
+ else
101
+ type = envelope['x-amz-cek-alg'].inspect
102
+ msg = "unsupported content encrypting key (cek) format: #{type}"
103
+ raise Errors::DecryptionError, msg
104
+ end
105
+ Utils.aes_decryption_cipher(block_mode, key, iv)
106
+ end
107
+
108
+ private
109
+
110
+ def validate_key_wrap(key_wrap_schema)
111
+ case key_wrap_schema
112
+ when :kms_context then 'kms+context'
113
+ else
114
+ raise ArgumentError, "Unsupported key_wrap_schema: #{key_wrap_schema}"
115
+ end
116
+ end
117
+
118
+ def validate_cek(content_encryption_schema)
119
+ case content_encryption_schema
120
+ when :aes_gcm_no_padding
121
+ "AES/GCM/NoPadding"
122
+ else
123
+ raise ArgumentError, "Unsupported content_encryption_schema: #{content_encryption_schema}"
124
+ end
125
+ end
126
+
127
+ def validate_kms_key(kms_key_id)
128
+ if kms_key_id.nil? || kms_key_id.length.zero?
129
+ raise ArgumentError, 'KMS CMK ID was not specified. ' \
130
+ 'Please specify a CMK ID, ' \
131
+ 'or set kms_key_id: :kms_allow_decrypt_with_any_cmk to use ' \
132
+ 'any valid CMK from the object.'
133
+ end
134
+
135
+ if kms_key_id.is_a?(Symbol) && kms_key_id != :kms_allow_decrypt_with_any_cmk
136
+ raise ArgumentError, 'kms_key_id must be a valid KMS CMK or be ' \
137
+ 'set to :kms_allow_decrypt_with_any_cmk'
138
+ end
139
+ kms_key_id
140
+ end
141
+
142
+ def build_encryption_context(cek_alg, options = {})
143
+ kms_context = (options[:kms_encryption_context] || {})
144
+ .each_with_object({}) { |(k, v), h| h[k.to_s] = v }
145
+ if kms_context.include? 'aws:x-amz-cek-alg'
146
+ raise ArgumentError, 'Conflict in reserved KMS Encryption Context ' \
147
+ 'key aws:x-amz-cek-alg. This value is reserved for the S3 ' \
148
+ 'Encryption Client and cannot be set by the user.'
149
+ end
150
+ {
151
+ 'aws:x-amz-cek-alg' => cek_alg
152
+ }.merge(kms_context)
153
+ end
154
+
155
+ def encode64(str)
156
+ Base64.encode64(str).split("\n") * ""
157
+ end
158
+
159
+ def decode64(str)
160
+ Base64.decode64(str)
161
+ end
162
+
163
+ def validate_key_for_encryption
164
+ if @kms_key_id == :kms_allow_decrypt_with_any_cmk
165
+ raise ArgumentError, 'Unable to encrypt/write objects with '\
166
+ 'kms_key_id = :kms_allow_decrypt_with_any_cmk. Provide ' \
167
+ 'a valid kms_key_id on client construction.'
168
+ end
169
+ end
170
+ end
171
+ end
172
+ end
173
+ end
@@ -0,0 +1,60 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'base64'
4
+
5
+ module Aws
6
+ module S3
7
+ module EncryptionV2
8
+ class Materials
9
+
10
+ # @option options [required, OpenSSL::PKey::RSA, String] :key
11
+ # The master key to use for encrypting/decrypting all objects.
12
+ #
13
+ # @option options [String<JSON>] :description ('{}')
14
+ # The encryption materials description. This is must be
15
+ # a JSON document string.
16
+ #
17
+ def initialize(options = {})
18
+ @key = validate_key(options[:key])
19
+ @description = validate_desc(options[:description])
20
+ end
21
+
22
+ # @return [OpenSSL::PKey::RSA, String]
23
+ attr_reader :key
24
+
25
+ # @return [String<JSON>]
26
+ attr_reader :description
27
+
28
+ private
29
+
30
+ def validate_key(key)
31
+ case key
32
+ when OpenSSL::PKey::RSA then key
33
+ when String
34
+ if [32, 24, 16].include?(key.bytesize)
35
+ key
36
+ else
37
+ msg = 'invalid key, symmetric key required to be 16, 24, or '\
38
+ '32 bytes in length, saw length ' + key.bytesize.to_s
39
+ raise ArgumentError, msg
40
+ end
41
+ else
42
+ msg = 'invalid encryption key, expected an OpenSSL::PKey::RSA key '\
43
+ '(for asymmetric encryption) or a String (for symmetric '\
44
+ 'encryption).'
45
+ raise ArgumentError, msg
46
+ end
47
+ end
48
+
49
+ def validate_desc(description)
50
+ Json.load(description)
51
+ description
52
+ rescue Json::ParseError, EncodingError
53
+ msg = 'expected description to be a valid JSON document string'
54
+ raise ArgumentError, msg
55
+ end
56
+
57
+ end
58
+ end
59
+ end
60
+ end
@@ -0,0 +1,103 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'openssl'
4
+
5
+ module Aws
6
+ module S3
7
+ module EncryptionV2
8
+ # @api private
9
+ module Utils
10
+
11
+ class << self
12
+
13
+ def encrypt_aes_gcm(key, data, auth_data)
14
+ cipher = aes_encryption_cipher(:GCM, key)
15
+ cipher.iv = (iv = cipher.random_iv)
16
+ cipher.auth_data = auth_data
17
+
18
+ iv + cipher.update(data) + cipher.final + cipher.auth_tag
19
+ end
20
+
21
+ def encrypt_rsa(key, data, auth_data)
22
+ # Plaintext must be KeyLengthInBytes (1 Byte) + DataKey + AuthData
23
+ buf = [data.bytesize] + data.unpack('C*') + auth_data.unpack('C*')
24
+ key.public_encrypt(buf.pack('C*'), OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING)
25
+ end
26
+
27
+ def decrypt(key, data)
28
+ begin
29
+ case key
30
+ when OpenSSL::PKey::RSA # asymmetric decryption
31
+ key.private_decrypt(data)
32
+ when String # symmetric Decryption
33
+ cipher = aes_cipher(:decrypt, :ECB, key, nil)
34
+ cipher.update(data) + cipher.final
35
+ end
36
+ rescue OpenSSL::Cipher::CipherError
37
+ msg = 'decryption failed, possible incorrect key'
38
+ raise Errors::DecryptionError, msg
39
+ end
40
+ end
41
+
42
+ def decrypt_aes_gcm(key, data, auth_data)
43
+ # data is iv (12B) + key + tag (16B)
44
+ buf = data.unpack('C*')
45
+ iv = buf[0,12].pack('C*') # iv will always be 12 bytes
46
+ tag = buf[-16, 16].pack('C*') # tag is 16 bytes
47
+ enc_key = buf[12, buf.size - (12+16)].pack('C*')
48
+ cipher = aes_cipher(:decrypt, :GCM, key, iv)
49
+ cipher.auth_tag = tag
50
+ cipher.auth_data = auth_data
51
+ cipher.update(enc_key) + cipher.final
52
+ end
53
+
54
+ # returns the decrypted data + auth_data
55
+ def decrypt_rsa(key, enc_data)
56
+ # Plaintext must be KeyLengthInBytes (1 Byte) + DataKey + AuthData
57
+ buf = key.private_decrypt(enc_data, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING).unpack('C*')
58
+ key_length = buf[0]
59
+ data = buf[1, key_length].pack('C*')
60
+ auth_data = buf[key_length+1, buf.length - key_length].pack('C*')
61
+ [data, auth_data]
62
+ end
63
+
64
+ # @param [String] block_mode "CBC" or "ECB"
65
+ # @param [OpenSSL::PKey::RSA, String, nil] key
66
+ # @param [String, nil] iv The initialization vector
67
+ def aes_encryption_cipher(block_mode, key = nil, iv = nil)
68
+ aes_cipher(:encrypt, block_mode, key, iv)
69
+ end
70
+
71
+ # @param [String] block_mode "CBC" or "ECB"
72
+ # @param [OpenSSL::PKey::RSA, String, nil] key
73
+ # @param [String, nil] iv The initialization vector
74
+ def aes_decryption_cipher(block_mode, key = nil, iv = nil)
75
+ aes_cipher(:decrypt, block_mode, key, iv)
76
+ end
77
+
78
+ # @param [String] mode "encrypt" or "decrypt"
79
+ # @param [String] block_mode "CBC" or "ECB"
80
+ # @param [OpenSSL::PKey::RSA, String, nil] key
81
+ # @param [String, nil] iv The initialization vector
82
+ def aes_cipher(mode, block_mode, key, iv)
83
+ cipher = key ?
84
+ OpenSSL::Cipher.new("aes-#{cipher_size(key)}-#{block_mode.downcase}") :
85
+ OpenSSL::Cipher.new("aes-256-#{block_mode.downcase}")
86
+ cipher.send(mode) # encrypt or decrypt
87
+ cipher.key = key if key
88
+ cipher.iv = iv if iv
89
+ cipher
90
+ end
91
+
92
+ # @param [String] key
93
+ # @return [Integer]
94
+ # @raise ArgumentError
95
+ def cipher_size(key)
96
+ key.bytesize * 8
97
+ end
98
+
99
+ end
100
+ end
101
+ end
102
+ end
103
+ end
@@ -0,0 +1,23 @@
1
+ require 'aws-sdk-s3/encryptionV2/client'
2
+ require 'aws-sdk-s3/encryptionV2/decrypt_handler'
3
+ require 'aws-sdk-s3/encryptionV2/default_cipher_provider'
4
+ require 'aws-sdk-s3/encryptionV2/encrypt_handler'
5
+ require 'aws-sdk-s3/encryptionV2/errors'
6
+ require 'aws-sdk-s3/encryptionV2/io_encrypter'
7
+ require 'aws-sdk-s3/encryptionV2/io_decrypter'
8
+ require 'aws-sdk-s3/encryptionV2/io_auth_decrypter'
9
+ require 'aws-sdk-s3/encryptionV2/key_provider'
10
+ require 'aws-sdk-s3/encryptionV2/kms_cipher_provider'
11
+ require 'aws-sdk-s3/encryptionV2/materials'
12
+ require 'aws-sdk-s3/encryptionV2/utils'
13
+ require 'aws-sdk-s3/encryptionV2/default_key_provider'
14
+
15
+ module Aws
16
+ module S3
17
+ module EncryptionV2
18
+ AES_GCM_TAG_LEN_BYTES = 16
19
+ EC_USER_AGENT = 'S3CryptoV2'
20
+ end
21
+ end
22
+ end
23
+
@@ -0,0 +1,178 @@
1
+ # frozen_string_literal: true
2
+
3
+ # WARNING ABOUT GENERATED CODE
4
+ #
5
+ # This file is generated. See the contributing guide for more information:
6
+ # https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
7
+ #
8
+ # WARNING ABOUT GENERATED CODE
9
+
10
+ module Aws::S3
11
+ # Endpoint parameters used to influence endpoints per request.
12
+ #
13
+ # @!attribute bucket
14
+ # The S3 bucket used to send the request. This is an optional parameter that will be set automatically for operations that are scoped to an S3 bucket.
15
+ #
16
+ # @return [String]
17
+ #
18
+ # @!attribute region
19
+ # The AWS region used to dispatch the request.
20
+ #
21
+ # @return [String]
22
+ #
23
+ # @!attribute use_fips
24
+ # When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.
25
+ #
26
+ # @return [Boolean]
27
+ #
28
+ # @!attribute use_dual_stack
29
+ # When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.
30
+ #
31
+ # @return [Boolean]
32
+ #
33
+ # @!attribute endpoint
34
+ # Override the endpoint used to send this request
35
+ #
36
+ # @return [String]
37
+ #
38
+ # @!attribute force_path_style
39
+ # When true, force a path-style endpoint to be used where the bucket name is part of the path.
40
+ #
41
+ # @return [Boolean]
42
+ #
43
+ # @!attribute accelerate
44
+ # When true, use S3 Accelerate. NOTE: Not all regions support S3 accelerate.
45
+ #
46
+ # @return [Boolean]
47
+ #
48
+ # @!attribute use_global_endpoint
49
+ # Whether the global endpoint should be used, rather then the regional endpoint for us-east-1.
50
+ #
51
+ # @return [Boolean]
52
+ #
53
+ # @!attribute use_object_lambda_endpoint
54
+ # Internal parameter to use object lambda endpoint for an operation (eg: WriteGetObjectResponse)
55
+ #
56
+ # @return [Boolean]
57
+ #
58
+ # @!attribute key
59
+ # The S3 Key used to send the request. This is an optional parameter that will be set automatically for operations that are scoped to an S3 Key.
60
+ #
61
+ # @return [String]
62
+ #
63
+ # @!attribute prefix
64
+ # The S3 Prefix used to send the request. This is an optional parameter that will be set automatically for operations that are scoped to an S3 Prefix.
65
+ #
66
+ # @return [String]
67
+ #
68
+ # @!attribute disable_access_points
69
+ # Internal parameter to disable Access Point Buckets
70
+ #
71
+ # @return [Boolean]
72
+ #
73
+ # @!attribute disable_multi_region_access_points
74
+ # Whether multi-region access points (MRAP) should be disabled.
75
+ #
76
+ # @return [Boolean]
77
+ #
78
+ # @!attribute use_arn_region
79
+ # When an Access Point ARN is provided and this flag is enabled, the SDK MUST use the ARN&#39;s region when constructing the endpoint instead of the client&#39;s configured region.
80
+ #
81
+ # @return [Boolean]
82
+ #
83
+ # @!attribute use_s3_express_control_endpoint
84
+ # Internal parameter to indicate whether S3Express operation should use control plane, (ex. CreateBucket)
85
+ #
86
+ # @return [Boolean]
87
+ #
88
+ # @!attribute disable_s3_express_session_auth
89
+ # Parameter to indicate whether S3Express session auth should be disabled
90
+ #
91
+ # @return [Boolean]
92
+ #
93
+ EndpointParameters = Struct.new(
94
+ :bucket,
95
+ :region,
96
+ :use_fips,
97
+ :use_dual_stack,
98
+ :endpoint,
99
+ :force_path_style,
100
+ :accelerate,
101
+ :use_global_endpoint,
102
+ :use_object_lambda_endpoint,
103
+ :key,
104
+ :prefix,
105
+ :disable_access_points,
106
+ :disable_multi_region_access_points,
107
+ :use_arn_region,
108
+ :use_s3_express_control_endpoint,
109
+ :disable_s3_express_session_auth,
110
+ ) do
111
+ include Aws::Structure
112
+
113
+ # @api private
114
+ class << self
115
+ PARAM_MAP = {
116
+ 'Bucket' => :bucket,
117
+ 'Region' => :region,
118
+ 'UseFIPS' => :use_fips,
119
+ 'UseDualStack' => :use_dual_stack,
120
+ 'Endpoint' => :endpoint,
121
+ 'ForcePathStyle' => :force_path_style,
122
+ 'Accelerate' => :accelerate,
123
+ 'UseGlobalEndpoint' => :use_global_endpoint,
124
+ 'UseObjectLambdaEndpoint' => :use_object_lambda_endpoint,
125
+ 'Key' => :key,
126
+ 'Prefix' => :prefix,
127
+ 'DisableAccessPoints' => :disable_access_points,
128
+ 'DisableMultiRegionAccessPoints' => :disable_multi_region_access_points,
129
+ 'UseArnRegion' => :use_arn_region,
130
+ 'UseS3ExpressControlEndpoint' => :use_s3_express_control_endpoint,
131
+ 'DisableS3ExpressSessionAuth' => :disable_s3_express_session_auth,
132
+ }.freeze
133
+ end
134
+
135
+ def initialize(options = {})
136
+ self[:bucket] = options[:bucket]
137
+ self[:region] = options[:region]
138
+ self[:use_fips] = options[:use_fips]
139
+ self[:use_fips] = false if self[:use_fips].nil?
140
+ if self[:use_fips].nil?
141
+ raise ArgumentError, "Missing required EndpointParameter: :use_fips"
142
+ end
143
+ self[:use_dual_stack] = options[:use_dual_stack]
144
+ self[:use_dual_stack] = false if self[:use_dual_stack].nil?
145
+ if self[:use_dual_stack].nil?
146
+ raise ArgumentError, "Missing required EndpointParameter: :use_dual_stack"
147
+ end
148
+ self[:endpoint] = options[:endpoint]
149
+ self[:force_path_style] = options[:force_path_style]
150
+ self[:force_path_style] = false if self[:force_path_style].nil?
151
+ if self[:force_path_style].nil?
152
+ raise ArgumentError, "Missing required EndpointParameter: :force_path_style"
153
+ end
154
+ self[:accelerate] = options[:accelerate]
155
+ self[:accelerate] = false if self[:accelerate].nil?
156
+ if self[:accelerate].nil?
157
+ raise ArgumentError, "Missing required EndpointParameter: :accelerate"
158
+ end
159
+ self[:use_global_endpoint] = options[:use_global_endpoint]
160
+ self[:use_global_endpoint] = false if self[:use_global_endpoint].nil?
161
+ if self[:use_global_endpoint].nil?
162
+ raise ArgumentError, "Missing required EndpointParameter: :use_global_endpoint"
163
+ end
164
+ self[:use_object_lambda_endpoint] = options[:use_object_lambda_endpoint]
165
+ self[:key] = options[:key]
166
+ self[:prefix] = options[:prefix]
167
+ self[:disable_access_points] = options[:disable_access_points]
168
+ self[:disable_multi_region_access_points] = options[:disable_multi_region_access_points]
169
+ self[:disable_multi_region_access_points] = false if self[:disable_multi_region_access_points].nil?
170
+ if self[:disable_multi_region_access_points].nil?
171
+ raise ArgumentError, "Missing required EndpointParameter: :disable_multi_region_access_points"
172
+ end
173
+ self[:use_arn_region] = options[:use_arn_region]
174
+ self[:use_s3_express_control_endpoint] = options[:use_s3_express_control_endpoint]
175
+ self[:disable_s3_express_session_auth] = options[:disable_s3_express_session_auth]
176
+ end
177
+ end
178
+ end