(upbeat music)
- Hello, I'm Rajitha.
A cloud support engineer,
here at the aws office in Bangalore, India.
Today, I'm gonna show you,
what you can do if your upload fails when trying
to upload a large file to Amazon S3.
With an encryption key that's using the AWS KMS key.
Let's get started.
If you want to upload objects larger than five gigabyte,
the objects must be uploaded in parts.
The AWS CLI,
SDK and AWS Management Console,
can automate some of those for you,
and break up the object into individual parts.
When all the parts are uploaded successfully,
all these uploaded parts must be assembled
to complete the multipart upload operation.
Because, the uploaded parts are server-side encrypted
using a KMS key,
each part must be decrypted before they can be assembled.
This is the reason why the requester needs,
kms:Decrypt permissions,
for S3 multipart upload API request,
using the server side encryption,
with KMS or SSE-KMS.
Now, let's walk through how the KMS encrypt
and decrypt permissions affect uploading objects
to Amazon S3.
I have already logged in to the AWS Management Console.
I'm going to use an IAM username test,
in this demonstration.
Let's review what the KMS key policy looks like
for this IAM user by visiting the KMS dashboard.
I'll navigate to the KMS dashboard.
And go to customer manage keys,
from my KMS key that's associated with my S3 bucket
to which I'm uploading the objects.
In the key policy,
search for the statement where the Amazon resource name
of your IAM user is listed as an AWS principle.
I used IAM user test for this purpose.
Check the list of actions allowed by this statement,
associated with your IAM user or role.
It looks like,
the IAM user has necessary came as
generate data key permissions,
which are sufficient if you're uploading objects
that are smaller than eight megabytes.
As of now,
the IAM user doesn't have KMS decrypt,
for multiple uploads to work.
Though, identity based permissions associated
with this IAM user,
includes S3 full access.
We can review the IAM permissions from the IAM dashboard,
users test permissions.
You can restrict these permissions based on your use case.
I'm going to use AWS CLI to upload objects
to my S3 bucket Amazon test pack.
I have configured a profile for my IAM user test,
with the access key and secret access key.
To use the a AWC CLI and configured profile for IAM users,
refer to the documentation linked to this video.
I have two files,
smallfile.txt and largefile.txt,
which are 672 kilobytes
and hundred megabytes respectively.
We can further confirm size of the files
by using ls -lh.
I'll first upload the smallfile.txt
to my S3 bucket.
Let's list the S3 bucket to confirm that.
Now, let's follow the same process
to upload the largefile.txt,
which is hundred megabytes.
That IAM user performing the upload,
doesn't have the necessary KMS decrypt permissions.
Amazon S3 fails to decrypt
and read data from the encrypted file parts,
before it completes the multipart upload.
Now, I'm back in the AWS Management Console.
We can verify the reason
for access denied exception from cloud trail as well.
Let's go to Amazon cloud trail console,
event history.
I will filter the events by username,
equal to test.
We see multiple generate data key calls,
which are used to encrypt the objects
that are uploaded to S3.
We can see many KMS decrypt API calls as well.
We can see the access denied exception associated
with the decrypt API action.
Let's view the entire cloud trail event.
From the event,
we see the principle is our IAM user test
and the invokedBy field is AWS Internal.
This information appears when an AWS service is performing
an API call on behalf of the IAM user.
In our case,
S3 is AWS service performing the decrypt API call,
to KMS endpoint,
kms.amazonaws.com,
on behalf of the IAM user.
Because the IAM user does not have
the required KMS decrypt permissions,
this fails.
So, let's fix the permissions of the IAM user.
Going back to the KMS console,
customer manage keys and the key policy.
And edit the key permissions.
I'll now add KMS decrypt permissions to my IAM user.
Let's retry it uploading the large file.
I'm back to the AWS CLI.
Since the session timed out,
I am logging back in.
Now, let's retry uploading the large file.
When you run the command,
you can see the status of the upload.
After the upload successfully completes
with the necessary permissions,
to further confirm,
I list the objects of my S3 bucket.
Now, I'm back on the IAM console.
If your IAM user
and KMS key belong to the same AWS account,
then using KMS decrypt permissions on the key policy
is good enough.
But, if your IAM user or role belongs
to a different account than the key,
then you must have permissions
to use KMS decrypt on both the key policy
and your IAM permissions.
You can review the identity based permissions associated
to the IAM user or role from the IAM dashboard.
I will go to the users,
and go to my user test.
An example IAM identity based policy
for cross account looks like this.
The policy has the necessary KMS permissions,
with the resource section
that specifies the cross account KMS key on.
Thanks for watching
and happy cloud computing from all of us here at aws.
(upbeat music)