[
https://issues.apache.org/jira/browse/NIFI-1769?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15339713#comment-15339713
]
ASF GitHub Bot commented on NIFI-1769:
--------------------------------------
Github user jvwing commented on the issue:
https://github.com/apache/nifi/pull/362
@miquillo, thanks for putting together this PR, Server-Side Encryption with
customer keys is a great feature for NiFi to have. I'm doing some review, and
considering the following topics:
* **NiFi's AWS SDK Version** - Since you submitted this PR, Amazon appears
to have made signature version 4 the default for S3 in their Java SDK v1.11.0,
May 13, 2016. NiFi's current SDK version is 1.10.32 from Nov 3, 2015.
Upgrading the SDK would apply much broader than this feature, but maybe not out
of line for the v1.0 release. If we chose not to upgrade now, we might
consider that in a future upgrade the signature version defaults will change.
* **Controlling Signature Versions** - Regardless of the SDK default, you
are absolutely right to make it optional. I'm a bit baffled by why Amazon uses
a System property to control this setting rather than a client or request
property, and a bit concerned about multiple processors fighting over the
signature version. I agree that `System.setProperty(...)` is the [documented
method of setting the signature
version](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html). But
I don't like it, I would prefer to set this more concisely than a global
setting. Are you familiar with
[`ClientConfiguration::setSignerOverride()`](http://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/ClientConfiguration.html#setSignerOverride(java.lang.String))?
It appears to allow this, if not so well documented.
* **SSE KMS for FetchS3Object** - We might also want to apply this feature
to the FetchS3Object processor, or at least to allow for that to happen in the
future. Have you considered moving some of the KMS logic to the
AbstractS3Processor class?
> Add support for SSE-KMS and S3 Signature Version 4 Authentication AWS
> ---------------------------------------------------------------------
>
> Key: NIFI-1769
> URL: https://issues.apache.org/jira/browse/NIFI-1769
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Affects Versions: 0.5.1
> Reporter: Michiel Moonen
> Priority: Minor
> Labels: newbie, patch, security
> Fix For: 1.0.0
>
>
> Currently there is no support for SSE-KMS S3 Signature Version 4
> Authentication. This is necessary for enhanced security features
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
