jojochuang commented on PR #11788: URL: https://github.com/apache/ozone/pull/11788#issuecomment-6480505144
Could we also update the S3 API documentation in a companion apache/ozone-site PR when this change lands? https://ozone.apache.org/docs/next/user-guide/client-interfaces/s3/s3-api/ It currently lists server-side encryption as unsupported. This PR does more than reject SSE-C: it validates and acknowledges AES256/aws:kms on encrypted buckets using the existing bucket TDE key, and rejects those requests on unencrypted buckets. The documentation should distinguish that limited header compatibility from Amazon S3-managed keys or AWS KMS integration, neither of which is added here, and describe the key-ID restrictions and unsupported encryption options. Suggested release note: > S3 Gateway now validates server-side encryption headers. Requests using `AES256` or `aws:kms` require an encrypted bucket and use its configured encryption key; requests to unencrypted buckets are rejected. SSE-C remains unsupported and is rejected. Previously, these headers were silently ignored. Generated-by: Codex (GPT-6) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
