Supporting Client Side Encryption when uploading/downloading to S3

[patrobinson]

Similar to #1466 I'd like to be able to use the aws-cli to encrypt/decrypt objects stored in an S3 bucket using Client-Side encryption, encrypted with a KMS key. This is possible via the various SDKs but not the CLI.

[jamesls]

Marking as a feature request. This is something we'd like to add.

[MichaelAquilina]

Has there been any progress on this? I'm wondering if theres some way I could help this feature out since I want it myself.

[chris-redekop]

+1

[shatil]

+1 a year later

[jnoxon]

+1

[vinhlh]

+1

[ameent]

+1 any ETAs on this?

[shatil]

Is the holdup because no client-side encryption is available in the Python SDK? http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html

(Since the AWS CLI is in Python, I'm guessing it uses the Python SDK, boto.)

[jaysw]

+1 another year later...

[ASayre]

Good Morning!

We're closing this issue here on GitHub, as part of our migration to UserVoice for feature requests involving the AWS CLI.

This will let us get the most important features to you, by making it easier to search for and show support for the features you care the most about, without diluting the conversation with bug reports.

As a quick UserVoice primer (if not already familiar): after an idea is posted, people can vote on the ideas, and the product team will be responding directly to the most popular suggestions.

We’ve imported existing feature requests from GitHub - Search for this issue there!

And don't worry, this issue will still exist on GitHub for posterity's sake. As it’s a text-only import of the original post into UserVoice, we’ll still be keeping in mind the comments and discussion that already exist here on the GitHub issue.

GitHub will remain the channel for reporting bugs.

Once again, this issue can now be found by searching for the title on: https://aws.uservoice.com/forums/598381-aws-command-line-interface

-The AWS SDKs & Tools Team

[salmanwaheed]

This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a temporary error. The following address(es) deferred: [email protected] Domain salmanwaheed.info has exceeded the max emails per hour (167/150 (111%)) allowed. Message will be reattempted later

…

------- This is a copy of the message, including all the headers. ------ ------ The body of the message is 6167 characters long; only the first ------ 5000 or so are included here. Received: from o6.sgmail.github.com ([192.254.113.101]:39270) by box1177.bluehost.com with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.89_1) (envelope-from <[email protected]>) id 1ej0Ps-001asq-0d for [email protected]; Tue, 06 Feb 2018 03:23:58 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=8bQtNL7PjDYapz1U77SEDcclmVY=; b=j24NvESaxMFVS+3J 7al9VIQNm3xx61/U2PZYybhu6oMFetbBXJMj3lQZIWp29M0VqUzvXq/Q1oLmAG2G ktZjJhe/2IzoIChZvYr2fcXIbUzdcsvzwzv6dAL343A+8bhfcTpQhri0E9nejX9e 2Y7kRpduglSEkEpeL6EkFdak5uQ= Received: by filter0612p1las1.sendgrid.net with SMTP id filter0612p1las1-7592-5A798231-1 2018-02-06 10:23:45.076325063 +0000 UTC Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2a-ext-cp1-prd.iad.github.net [192.30.253.16]) by ismtpd0001p1iad2.sendgrid.net (SG) with ESMTP id nkB464cOS-Wuz4fx9_hAuw for <[email protected]>; Tue, 06 Feb 2018 10:23:45.041 +0000 (UTC) Date: Tue, 06 Feb 2018 10:23:45 +0000 (UTC) From: Andre Sayre <[email protected]> Reply-To: aws/aws-cli <[email protected]> To: aws/aws-cli <[email protected]> Cc: Subscribed <[email protected]> Message-ID: <aws/aws-cli/issues/1686/[email protected]> In-Reply-To: <aws/aws-cli/issues/[email protected]> References: <aws/aws-cli/issues/[email protected]> Subject: Re: [aws/aws-cli] Supporting Client Side Encryption when uploading/downloading to S3 (#1686) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5a798230db048_66dd2b1b0c3fcecc5791a0"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: ASayre X-GitHub-Recipient: salmanwaheed X-GitHub-Reason: subscribed List-ID: aws/aws-cli <aws-cli.aws.github.com> List-Archive: https://github.com/aws/aws-cli List-Post: <mailto:[email protected]> List-Unsubscribe: <mailto:unsub+00ef1b3831ef01a550b6709e57542988930b1417a929353e92cf000000011691443092a169ce07530d6f@reply.github.com>, <https://github.com/notifications/unsubscribe/AO8bOEean1vLIkEfa3dBNUcOLojQ2RcHks5tSCgwgaJpZM4G36L2> X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: [email protected] X-SG-EID: 92ws1MVnlto3blxqXlf5goB0ee0kdDGWR6vcWx8d648O1HE9oN7E7pyqSAwxgiohWoAD1fKKKGo3LE OvwZg+hDEzDLzLW5BlJ33DbPEmwanHACv8ycbOnY9FnM7Dy1Kqkbt+fOw1ZCf4f3RWOgempOcdgqs7 gv7tSnusSuEjF7a/VgUwQ4XFQzqseZzbxBZ7vDTH0H2FYZjW381/ztaehqBn6v7oczvcl5cYxjl+AJ M= X-Spam-Status: No, score=-1.4 X-Spam-Score: -13 X-Spam-Bar: - X-Ham-Report: Spam detection software, running on the system "box1177.bluehost.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Good Morning! We're closing this issue here on GitHub, as part of our migration to [UserVoice](https://aws.uservoice.com/forums/598381-aws-command-line-interface) for feature requests involving the AWS CLI. [...] Content analysis details: (-1.4 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: uservoice.com] -0.5 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [192.254.113.101 listed in wl.mailspike.net] -0.5 SPF_PASS SPF: sender matches SPF record -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain 0.0 HTML_MESSAGE BODY: HTML included in message -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.3 AWL AWL: Adjusted score from AWL reputation of From: address X-Spam-Flag: NO

----==_mimepart_5a798230db048_66dd2b1b0c3fcecc5791a0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Good Morning! We're closing this issue here on GitHub, as part of our migration to [UserV= oice](https://aws.uservoice.com/forums/598381-aws-command-line-interface) f= or feature requests involving the AWS CLI. This will let us get the most important features to you, by making it easie= r to search for and show support for the features you care the most about, = without diluting the conversation with bug reports. As a quick UserVoice primer (if not already familiar): after an idea is pos= ted, people can vote on the ideas, and the product team will be responding = directly to the most popular suggestions. We=E2=80=99ve imported existing feature requests from GitHub - Search for t= his issue there! And don't worry, this issue will still exist on GitHub for posterity's sake= . As it=E2=80=99s a text-only import of the original post into UserVoice, = we=E2=80=99ll still be keeping in mind the comments and discussion that alr= eady exist here on the GitHub issue. GitHub will remain the channel for reporting bugs.=20=20 Once again, this issue can now be found by searching for the title on: http= s://aws.uservoice.com/forums/598381-aws-command-line-interface=20

-The AWS SDKs & Tools Team

--=20 You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #1686 (comment)=

----==_mimepart_5a798230db048_66dd2b1b0c3fcecc5791a0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <p>Good Morning!</p> <p>We're closing this issue here on GitHub, as part of our migration to <a = href=3D"https://aws.uservoice.com/forums/598381-aws-command-line-interface"= rel=3D"nofollow">UserVoice</a> for feature requests involving the AWS CLI.= </p> <p>This will let us get the most important features to you, by making it ea= sier to search for and show support for the features you care the most abou= t, without diluting the conversation with bug reports.</p> <p>As a quick UserVoice primer (if not already familiar): after an idea is = posted, people can vote on the ideas, and the product team will be respondi= ng directly to the most popular suggestions.</p> <p>We=E2=80=99ve imported existing feature requests from GitHub - Search fo= r this issue there!</p> <p>And don't worry, this issue will still exist on GitHub for posterity's s= ake. As it=E2=80=99s a text-only import of the original post into UserVoic= e, we=E2=80=99ll still be keeping in mind the comments and discussion that = already exist here on the GitHub issue.</p> <p>GitHub will remain the channel for reporting bugs.</p> <p>Once again, this issue can now be found by searching for the title on: <= a href=3D"https://aws.uservoice.com/forums/598381-aws-command-line-interfac= e" rel=3D"nofollow">https://aws.uservoice.com/forums/598381-aws-command-lin= e-interface</a></p> <p>-The AWS SDKs &amp; Tools Team</p> <p style=3D"font-size:small;-webkit-text-size-adjust:none;color:#666;">&mda= sh;<br />You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, <a href=3D"https://github.com/aws/aws-cl= i/issues/1686#issuecomment-363378081">view it on GitHub</a>, or <a href=3D"= https://github.com/notifications/unsubscribe-auth/AO8bOMW_f3D3WDENZ8a2AajOu= zZM5Ez5ks5tSCgwgaJpZM4G36L2">mute the thread</a>.<img alt=3D"" height=3D"1"= src=3D"https://github.com/notifications/beacon/AO8bOHhRDUzOESicNHob5pM84Vm= xSow0ks5tSCgwgaJpZM4G36L2.gif" width=3D"1" /></p> <div itemscope itemtype=3D"http://schema.org/EmailMessage"> <div itemprop=3D"action" itemscope itemtype=3D"http://schema.org/ViewAction= "> <link itemprop=3D"url" href=3D"#1686= #issuecomment-363378081"></link> <meta itemprop=3D"name" content=3D"View Issue"></meta> </div> <meta itemprop=3D"description" content=3D"View this Issue on GitHub"></meta> </div> <script type=3D"application/json" data-scope=3D"inboxmarkup">{"api_version"= :"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"Gi= tHub"},"entity":{"external_key":"github/aws/aws-cli","title":"aws/aws-cli",= "subtitle":"GitHub repository","main_image_url":"https://cloud.githubuserco= ntent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png",= "avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842= 166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open in Git= Hub","url":"https://github.com/aws/aws-cli"}},"updates":{"snippets":[{"icon= ":"PERSON","message":"@ASayre in #1686: Good Morning!\r\n\r\nWe're closing = this issue here on GitHub, as part of our migration to [UserVoice](https://= aws.uservoice.com/forums/598381-aws-command-line-interface) for feature req= uests involving the AWS CLI.\r\n\r\nThis will let us get the most important= features to

[salmanwaheed]

This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a temporary error. The following address(es) deferred: [email protected] Domain salmanwaheed.info has exceeded the max emails per hour (166/150 (110%)) allowed. Message will be reattempted later

…

------- This is a copy of the message, including all the headers. ------ Received: from o1.sgmail.github.com ([192.254.114.176]:40277) by box1177.bluehost.com with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.89_1) (envelope-from <[email protected]>) id 1ej0Pt-001asr-9b for [email protected]; Tue, 06 Feb 2018 03:23:57 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=8mK9YSgFWld6gd1rw1/s/pUV7qc=; b=wYdyr9/v4mQmGWXl VNjxqylLV66PNWCmbHGcyND7a3prwfDP1a80PLfQbKRrMuzWDCCXxpwZ2Yc/ik5T DL6Fwy4aVLcv1wD5v0jScmjXugssj9TL5DC3LFLKgPY+fcQyhMf9vLaodaz/m6Ek 2jBEr2tymbwN8LPxmTD4GSSsEqk= Received: by filter1260p1mdw1.sendgrid.net with SMTP id filter1260p1mdw1-32039-5A798231-3 2018-02-06 10:23:45.201294981 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0023p1iad2.sendgrid.net (SG) with ESMTP id 6xuRaVMRRAi12PGBDIRe4g for <[email protected]>; Tue, 06 Feb 2018 10:23:45.222 +0000 (UTC) Date: Tue, 06 Feb 2018 10:23:45 +0000 (UTC) From: Andre Sayre <[email protected]> Reply-To: aws/aws-cli <[email protected]> To: aws/aws-cli <[email protected]> Cc: Subscribed <[email protected]> Message-ID: <aws/aws-cli/issue/1686/issue_event/[email protected]> In-Reply-To: <aws/aws-cli/issues/[email protected]> References: <aws/aws-cli/issues/[email protected]> Subject: Re: [aws/aws-cli] Supporting Client Side Encryption when uploading/downloading to S3 (#1686) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5a7982318777_49292ac7ff27eed43848aa"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: ASayre X-GitHub-Recipient: salmanwaheed X-GitHub-Reason: subscribed List-ID: aws/aws-cli <aws-cli.aws.github.com> List-Archive: https://github.com/aws/aws-cli List-Post: <mailto:[email protected]> List-Unsubscribe: <mailto:unsub+00ef1b38b15eed1ce7549d22fa215d6f8e49091e95690c2092cf000000011691443192a169ce07530d6f@reply.github.com>, <https://github.com/notifications/unsubscribe/AO8bOJ_X0L-wlLIKI7Nah2RjjEGiu_cHks5tSCgxgaJpZM4G36L2> X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: [email protected] X-SG-EID: 92ws1MVnlto3blxqXlf5goB0ee0kdDGWR6vcWx8d64/J1bn7crZ4L/nlWPhoDa11fYMOexp+ArBhqs BRGdMV6Ze7nAOCO1HtiFfVxywsiEryVzl4b+hXxwtatJVUaPJhjUTsoa2DnCstMefrKavBxQEl+PQL KFLnLpxuQ/gJc9Y/4hOwoU2x5lvIqvkQEICa/i0GTUC+IVm/YkmagVCjch1q++7iE/LGBH2q9KVpQ+ E= X-Spam-Status: No, score=-0.3 X-Spam-Score: -2 X-Spam-Bar: / X-Ham-Report: Spam detection software, running on the system "box1177.bluehost.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Closed #1686. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #1686 (comment) Closed #1686. [...] Content analysis details: (-0.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: github.com] -0.5 SPF_PASS SPF: sender matches SPF record -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain 0.0 HTML_MESSAGE BODY: HTML included in message 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 2.5 DCC_CHECK No description available. -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.8 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [192.254.114.176 listed in wl.mailspike.net] -0.8 RCVD_IN_MSPIKE_WL Mailspike good senders -1.4 AWL AWL: Adjusted score from AWL reputation of From: address X-Spam-Flag: NO

----==_mimepart_5a7982318777_49292ac7ff27eed43848aa Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #1686.

-- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #1686 (comment) ----==_mimepart_5a7982318777_49292ac7ff27eed43848aa Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit <p>Closed <a href="#1686" class="issue-link js-issue-link" data-error-text="Failed to load issue title" data-id="122883439" data-permission-text="Issue title is private" data-url="#1686">#1686</a>.</p> <p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="#1686 (comment)">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AO8bODbaqrOimfWEfNoxGnbKylquC5Lbks5tSCgxgaJpZM4G36L2">mute the thread</a>.<img alt="" height="1" src="https://github.com/notifications/beacon/AO8bONC937ASXFLfdVsu9R9e8Pz071nSks5tSCgxgaJpZM4G36L2.gif" width="1" /></p> <div itemscope itemtype="http://schema.org/EmailMessage"> <div itemprop="action" itemscope itemtype="http://schema.org/ViewAction"> <link itemprop="url" href="#1686 (comment)"></link> <meta itemprop="name" content="View Issue"></meta> </div> <meta itemprop="description" content="View this Issue on GitHub"></meta> </div> <script type="application/json" data-scope="inboxmarkup">{"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/aws/aws-cli","title":"aws/aws-cli","subtitle":"GitHub repository","main_image_url":"https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open in GitHub","url":"https://github.com/aws/aws-cli"}},"updates":{"snippets":[{"icon":"DESCRIPTION","message":"Closed #1686."}],"action":{"name":"View Issue","url":"#1686 (comment)"}}}</script> ----==_mimepart_5a7982318777_49292ac7ff27eed43848aa--

[jamesls]

Based on community feedback, we have decided to return feature requests to GitHub issues.

[tim-finnigan]

Linking related issue: boto/boto3#3395