如何使用 AmazonS3EncryptionClientV2 客戶端加密從 AWS S3 存儲桶下載 object？

Question

我們在代碼中使用 AmazonS3EncryptionClient 來使用客戶端加密與 S3 存儲桶進行交互。 但是在今天更新 nuget package 時，我注意到 AmazonS3EncryptionClient 已被標記為過時。 如果我們想要繼續進行持續更新，看起來我們需要使用 AmazonS3EncryptionClientV2。 我在嘗試從 AmazonS3EncryptionClient 遷移到 AmazonS3EncryptionClientV2 時遇到此問題。

在我們的舊代碼中，我們使用將 RegionEnpoint 作為參數的 AmazonS3EncryptionClient 構造函數。 見下圖。 看起來采用 RegionEnpoint 的構造函數已在 AmazonS3EncryptionClientV2 中刪除。

用於從 S3 存儲桶獲取對象的舊代碼。

S3BucketConfiguration _s3BucketConfiguration = provider
   .GetService<IOptionsSnapshot<S3BucketConfiguration>>()
   .Value;

var credential = new BasicAWSCredentials(
    _s3BucketConfiguration.AccessKey, _s3BucketConfiguration.SecurityKey);

RegionEndpoint bucketRegion =
    RegionEndpoint.GetBySystemName(_s3BucketConfiguration.Region);

EncryptionMaterials encryptionMaterials = new EncryptionMaterials(_s3BucketConfiguration.KMSKeyId);

var client = new AmazonS3EncryptionClient(credential, bucketRegion, encryptionMaterials);

GetObjectResponse response = await _client.GetObjectAsync(new GetObjectRequest
{
    BucketName = _s3BucketConfig.BucketName,
    Key = filePath
});

我無法在 AmazonS3EncryptionClientV2 中傳入 RegionEnpoint。

到目前為止我的代碼。

S3BucketConfiguration _s3BucketConfiguration = provider
   .GetService<IOptionsSnapshot<S3BucketConfiguration>>()
   .Value;

var credential = new BasicAWSCredentials(
    _s3BucketConfiguration.AccessKey, _s3BucketConfiguration.SecurityKey);

RegionEndpoint bucketRegion =
    RegionEndpoint.GetBySystemName(_s3BucketConfiguration.Region);

var encryptionMaterials = new EncryptionMaterialsV2(
    _s3BucketConfiguration.KMSKeyId, 
    KmsType.KmsContext, 
    new Dictionary<string, string>()
);

var config = new AmazonS3CryptoConfigurationV2(SecurityProfile.V2AndLegacy);

//If I add this line it will instantiate AmazonS3EncryptionClientV2 but, the GetObject call fails.
//If I do not add this line, it will give me same error while instiantiating AmazonS3EncryptionClientV2
//config.RegionEndpoint = bucketRegion; 

vr client = new AmazonS3EncryptionClientV2(credential, config, encryptionMaterials);

GetObjectResponse response = client.GetObjectAsync(new GetObjectRequest
{
    BucketName = _s3BucketConfig.BucketName,
    Key = filePath,
}).GetAwaiter().GetResult();

例外

No RegionEndpoint or ServiceURL configured

Answer 1

我可以使用 V1 成功加密並使用 V2 客戶端解密，同時傳遞RegionEndpoint 。

var configuration = new AmazonS3CryptoConfiguration()
{
    RegionEndpoint = RegionEndpoint.USWest2
};
var material = new EncryptionMaterials(KmsKeyId);
var client = new AmazonS3EncryptionClient(configuration, material);

var putObjectResponse = await client.PutObjectAsync(new PutObjectRequest()
{
    ContentBody = ContentBody,
    BucketName = Bucket,
    Key = Key
});

if (putObjectResponse.HttpStatusCode == System.Net.HttpStatusCode.OK)
{
    var configurationV2 = new AmazonS3CryptoConfigurationV2(SecurityProfile.V2AndLegacy)
    {
        RegionEndpoint = RegionEndpoint.USWest2
    };
    var materialV2 = new EncryptionMaterialsV2(KmsKeyId, KmsType.KmsContext, new Dictionary<string, string>());
    var clientV2 = new AmazonS3EncryptionClientV2(configurationV2, materialV2);

    var getObjectResponse = await clientV2.GetObjectAsync(new GetObjectRequest()
    {
        BucketName = Bucket,
        Key = Key
    });

    using (var reader = new StreamReader(getObjectResponse.ResponseStream))
    {
        Console.WriteLine(reader.ReadToEnd());
    }
}

你能確保在加密和解密過程中使用相同的RegionEndpoint嗎？