ASF GitHub Bot commented on NIFI-4256:
Github user jvwing commented on the issue:
@baank Thanks for putting together this PR, it looks like you put a lot of
thought into covering all the possible encryption scenarios. I haven't run it
yet, but I have a few starter questions after looking over some of the code:
1. What was the driver behind updating the AWS SDK version?
1. Although the service interfaces and their methods are named specific to
encryption, the substance of their interaction are not necessarily limited to
encryption. What would you think about making the interfaces more generic?
* Could the S3ClientSideEncryptionService be "S3ClientService" with
only `getClient` methods, with the `needsEncryptedClient()` logic being
performed internally by the concrete implementation
StandardS3ClientSideEncryptionService. I can see a number of use cases beyond
encryption that could be covered by a custom client factory.
* Could the S3ServerSideEncryptionService be a more generic S3 put
request modifier? My efforts at thinking up a good name failed miserably here.
But the interface allows many non-encryption modifications of an S3 request,
which might indeed be useful, despite the `encrypt()` naming of the methods.
> Add support for all AWS S3 Encryption Options
> Key: NIFI-4256
> URL: https://issues.apache.org/jira/browse/NIFI-4256
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Affects Versions: 1.2.0
> Reporter: Franco
> Labels: aws, aws-s3, security
> Fix For: 1.4.0
> NiFi currently only supports SSE-S3 encryption (AES256).
> Support needs to be added for:
> * SSE-S3
> * SSE-KMS
> * SSE-C
> * CSE-KMS CMK
> * CSE-Master Key
> With all of the appropriate configuration options and such that SSE is
> available only for PutS3Object whilst CSE is available also for FetchS3Object.
> Given that this will add another 20 or so UI properties the intention is to
> split it into a Client Side Encryption Service and Server Side Encryption
> Service. This will allow users to reuse "encryption" across different
> Existing flows using the Server Side Encryption option will still work as is
> but will be overridden if a service is added.
This message was sent by Atlassian JIRA