out_s3: add support for server-side encryption headers #10901
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add configuration options to enable server-side encryption when uploading files to S3, supporting both AWS managed and customer managed KMS keys. This implementation follows AWS S3 documentation guidelines and adds support for the following encryption headers: * x-amz-server-side-encryption - Supported values: AES256, aws:kms, aws:kms:dsse * x-amz-server-side-encryption-aws-kms-key-id - Required when using customer managed KMS keys The feature allows users to encrypt their log data at rest in S3 buckets using their preferred encryption method. Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html Signed-off-by: Rishabh Sharma <[email protected]>
cosmo0920
requested changes
Oct 17, 2025
Comment on lines
+4156
to
+4162
| FLB_CONFIG_MAP_STR, "server-side-encryption", NULL, | ||
| 0, FLB_TRUE, offsetof(struct flb_s3, server_side_encryption), | ||
| "Server-side encryption type for S3 objects. Valid values: AES256, aws:kms, aws:kms:dsse. " | ||
| "When not specified, S3 applies the bucket's default encryption settings or SSE-S3 if no default is configured." | ||
| }, | ||
| { | ||
| FLB_CONFIG_MAP_STR, "server-side-encryption-aws-kms-key-id", NULL, |
There was a problem hiding this comment.
We need to use snake_case instead of kebab-case for parameter names.
|
|
||
| /* Validate sse values */ | ||
| if (ctx->server_side_encryption != NULL) { | ||
| if (strcmp(ctx->server_side_encryption, "AES256") != 0 && |
There was a problem hiding this comment.
We needn't to distinguish upper case or lower case.
So, we need to use strcasecmp instead of strcmp.
Plus, we need to verify with length, too.
On paper, it needs to use strncasecmp here.
Comment on lines
+876
to
+881
| tmp = flb_output_get_property("server-side-encryption-aws-kms-key-id", ins); | ||
| if (tmp) { | ||
| ctx->server_side_encryption_aws_kms_key_id = (char *) tmp; | ||
| } | ||
|
|
||
| tmp = flb_output_get_property("server-side-encryption", ins); |
There was a problem hiding this comment.
After modifying to use camel_case on config_map, we need to fix using case_case here, too.
| flb_plg_error(ctx->ins, "server-side-encryption-aws-kms-key-id requires server-side-encryption to be 'aws:kms' or 'aws:kms:dsse'"); | ||
| return -1; | ||
| } | ||
| if (strcmp(ctx->server_side_encryption, "aws:kms") != 0 && |
There was a problem hiding this comment.
Same here for being needed to use strncasecmp.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add configuration options to enable server-side encryption when uploading files to S3, supporting both AWS managed and customer managed KMS keys.
This implementation follows AWS S3 documentation guidelines and adds support for the following encryption headers:
The feature allows users to encrypt their log data at rest in S3 buckets using their preferred encryption method.
Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html
Enter
[N/A]in the box, if an item is not applicable to your change.Testing
Before we can approve your change; please submit the following in a comment:
Masking s3 bucket name and kms key arn in the logs
valid_no_sse.conf
valid_sse_aes256.conf
valid_sse_kms.conf
valid_sse_kms_dsse.conf
valid_sse_kms_with_key.conf
valid_sse_kms_dsse_with_key.conf
invalid_sse_value.conf
kms_key_without_sse.conf
kms_key_with_aes256.conf
If this is a change to packaging of containers or native binaries then please confirm it works for all targets.
ok-package-testlabel to test for all targets (requires maintainer to do).Documentation
Backporting
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.