[dvasilas]

Context

Master encryption key ID in responses

Cloudserver returns the key ID of the master encryption key for aws:kms encryption.

• In object operations such as PutObject and HeadObject, the key ID is returned in the x-amz-server-side-encryption-aws-kms-key-id header.
• In GetBucketEncryption, the key ID is in the KMSMasterKeyID element of the response.

With kmsHideScalityArn on (the default), Cloudserver removes the ARN prefix: arn:scality:kms:external:kmip:thales2:key/54 is returned as 54.
The prefix names the KMS; 54 contains no information about which KMS it belongs to.

Master encryption key ID in requests

An end user can send a key ID in requests, for example, to choose the key that encrypts an object on PutObject.
If the provided key ID lacks an ARN prefix, Cloudserver sends the key ID to the default KMS.

Problems

Keys in another KMS

When multiple KMSs are configured, and an end user passes a key ID that Cloudserver returned in a later request, the key ID may not refer to the same key.

Example:

• The default KMS is thales, and thales2 is another KMS.
• An object is encrypted with arn:scality:kms:external:kmip:thales2:key/54.
• HeadObject returns 54, without a prefix.
• A PutObject with 54 goes to the default KMS and uses arn:scality:kms:external:kmip:thales:key/54

Result: If thales has a key 54, the new object is encrypted with that key in thales instead of the key in thales2 that the end user meant, with no error. Otherwise, the request fails.

Keys stored without prefix

Cloudserver returns a key stored without a prefix as stored, whether kmsHideScalityArn is on or off.
Keys written before Cloudserver started storing keys with an ARN prefix are stored without a prefix.
SSE migration declares that keys without a prefix belong to the SSE-migration KMS.

Example:

• SSE migration is set.
• Cloudserver returns a key as stored, for example abcd.
• A PutObject with abcd goes to the default KMS, but the key belongs to the SSE-migration KMS.

Result: if the default KMS has a key abcd, the new object is encrypted with it, with no error. Otherwise, the request fails.

Changes

With kmsHideScalityArn on, S3C removes the prefix only for keys in the default KMS.

• Keys in the default KMS are returned as before: 54.
• Keys in other KMSs are returned as full ARNs: arn:scality:kms:external:kmip:thales2:key/54.
• With SSE migration set, a key stored without a prefix belongs to the SSE-migration KMS. It is returned with that KMS's prefix, for example arn:scality:kms:internal:file:scality:key/abcd.

With kmsHideScalityArn off, key IDs are returned as stored, except for keys stored without a prefix that belong to the SSE-migration KMS; those are returned with that KMS's prefix as well.

[bert-e]

Hello dvasilas,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
/after_pull_request	Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval	Bypass the pull request author's approval	⭐
/bypass_build_status	Bypass the build and test status	⭐
/bypass_commit_size	Bypass the check on the size of the changeset TBA	⭐
/bypass_incompatible_branch	Bypass the check on the source branch prefix	⭐
/bypass_jira_check	Bypass the Jira issue check	⭐
/bypass_peer_approval	Bypass the pull request peers' approval	⭐
/bypass_leader_approval	Bypass the pull request leaders' approval	⭐
/bypass_source_branch_lineage	Bypass the cross-branch contamination check	⭐
/approve	Instruct Bert-E that the author has approved the pull request.		✍️
/create_pull_requests	Allow the creation of integration pull requests.
/create_integration_branches	Allow the creation of integration branches.
/no_octopus	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity	Change review acceptance criteria from one reviewer at least to all reviewers
/wait	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
/help	Print Bert-E's manual in the pull request.
/status	Print Bert-E's current status in the pull request.
/clear	Remove all comments from Bert-E from the history TBA
/retry	Re-start a fresh build TBA
/build	Re-start a fresh build TBA
/force_reset	Delete integration branches & pull requests, and restart merge process from the beginning.
/reset	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

[bert-e]

Waiting for approval

The following approvals are needed before I can proceed with the merge:

• the author

• 2 peers