[ 
https://issues.apache.org/jira/browse/NIFI-4256?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16121066#comment-16121066
 ] 

ASF GitHub Bot commented on NIFI-4256:
--------------------------------------

Github user jvwing commented on the issue:

    https://github.com/apache/nifi/pull/2066
  
    @baank Thanks for putting together this PR, it looks like you put a lot of 
thought into covering all the possible encryption scenarios.  I haven't run it 
yet, but I have a few starter questions after looking over some of the code:
    
    1. What was the driver behind updating the AWS SDK version?
    1. Although the service interfaces and their methods are named specific to 
encryption, the substance of their interaction are not necessarily limited to 
encryption.  What would you think about making the interfaces more generic?  
For example:
        * Could the S3ClientSideEncryptionService be "S3ClientService" with 
only `getClient` methods, with the `needsEncryptedClient()` logic being 
performed internally by the concrete implementation 
StandardS3ClientSideEncryptionService.  I can see a number of use cases beyond 
encryption that could be covered by a custom client factory.
        * Could the S3ServerSideEncryptionService be a more generic S3 put 
request modifier?  My efforts at thinking up a good name failed miserably here. 
 But the interface allows many non-encryption modifications of an S3 request, 
which might indeed be useful, despite the `encrypt()` naming of the methods.


> Add support for all AWS S3 Encryption Options
> ---------------------------------------------
>
>                 Key: NIFI-4256
>                 URL: https://issues.apache.org/jira/browse/NIFI-4256
>             Project: Apache NiFi
>          Issue Type: Improvement
>          Components: Core Framework
>    Affects Versions: 1.2.0
>            Reporter: Franco
>              Labels: aws, aws-s3, security
>             Fix For: 1.4.0
>
>
> NiFi currently only supportsĀ SSE-S3 encryption (AES256).
> Support needs to be added for:
> * SSE-S3
> * SSE-KMS
> * SSE-C
> * CSE-KMS CMK
> * CSE-Master Key
> With all of the appropriate configuration options and such that SSE is 
> available only for PutS3Object whilst CSE is available also for FetchS3Object.
> Given that this will add another 20 or so UI properties the intention is to 
> split it into a Client Side Encryption Service and Server Side Encryption 
> Service. This will allow users to reuse "encryption" across different 
> workflows.
> Existing flows using the Server Side Encryption option will still work as is 
> but will be overridden if a service is added.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Reply via email to