Fail to upload file encrypted with KMS key, but works on the downalod

[bailejl]

When trying to put a file to a S3 bucket it fails. The S3 bucket is private with versioning on. The file is using a KMS key to secure it. When I use a get to pull the file from the S3 bucket it works as planned, but when I do a put it fails with this error:

error running command: InvalidArgument: Server Side Encryption with AWS KMS managed key requires HTTP header x-amz-server-side-encryption : aws:kms
	status code: 400, request id: 04541E0A8076886F

Any help is appreciated.

[concourse-bot]

Hi there!

We use Pivotal Tracker to provide visibility into what our team is working on. A story for this issue has been automatically created.

The current status is as follows:

• #135354803 Fail to upload file encrypted with KMS key, but works on the downalod

This comment, as well as the labels on the issue, will be automatically updated as the status in Tracker changes.

[pms1969]

Bump. running into the exact same put problem.

Any progress?

[jtarchie]

@bailejl && @pms1969: It looks like the value is not being passed for the encryption. I'd accept a PR with that change.

[pms1969]

IIRC, the work around for me was not to specify the key. (it was the default anyway) But it was a while ago now, so that could be complete whaffle.

I'll try and replicate it again, and produce a PR.

[geofffranks]

Ran into this today with our private KMS encrypted bucket trying to put a blob up to it. No combination of setting server_side_encryption: aws:kms, sse_kms_key_id: my-id , private: true and use_v2_signing: false was helping.

Happy to try to PR this, but not sure if the code linked above is still relevant to the problem. Any ideas @jtarchie / @vito ?

[geofffranks]

Actually the error we're getting is slightly different:

error running command: InvalidArgument: Requests specifying Server Side Encryption with AWS KMS managed keys require AWS Signature Version 4.
	status code: 400, request id:, host id: 

[geofffranks]

Does it just need something like https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/s3-example-presigned-urls.html implemented for the requests if use_v2_signing is disabled?