nifi-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <>
Subject [jira] [Commented] (NIFI-4256) Add support for all AWS S3 Encryption Options
Date Thu, 10 Aug 2017 05:19:00 GMT


ASF GitHub Bot commented on NIFI-4256:

Github user jvwing commented on the issue:
    @baank Thanks for putting together this PR, it looks like you put a lot of thought into
covering all the possible encryption scenarios.  I haven't run it yet, but I have a few starter
questions after looking over some of the code:
    1. What was the driver behind updating the AWS SDK version?
    1. Although the service interfaces and their methods are named specific to encryption,
the substance of their interaction are not necessarily limited to encryption.  What would
you think about making the interfaces more generic?  For example:
        * Could the S3ClientSideEncryptionService be "S3ClientService" with only `getClient`
methods, with the `needsEncryptedClient()` logic being performed internally by the concrete
implementation StandardS3ClientSideEncryptionService.  I can see a number of use cases beyond
encryption that could be covered by a custom client factory.
        * Could the S3ServerSideEncryptionService be a more generic S3 put request modifier?
 My efforts at thinking up a good name failed miserably here.  But the interface allows many
non-encryption modifications of an S3 request, which might indeed be useful, despite the `encrypt()`
naming of the methods.

> Add support for all AWS S3 Encryption Options
> ---------------------------------------------
>                 Key: NIFI-4256
>                 URL:
>             Project: Apache NiFi
>          Issue Type: Improvement
>          Components: Core Framework
>    Affects Versions: 1.2.0
>            Reporter: Franco
>              Labels: aws, aws-s3, security
>             Fix For: 1.4.0
> NiFi currently only supportsĀ SSE-S3 encryption (AES256).
> Support needs to be added for:
> * SSE-S3
> * SSE-C
> * CSE-Master Key
> With all of the appropriate configuration options and such that SSE is available only
for PutS3Object whilst CSE is available also for FetchS3Object.
> Given that this will add another 20 or so UI properties the intention is to split it
into a Client Side Encryption Service and Server Side Encryption Service. This will allow
users to reuse "encryption" across different workflows.
> Existing flows using the Server Side Encryption option will still work as is but will
be overridden if a service is added.

This message was sent by Atlassian JIRA

View raw message