7

I'm implementing an upload to S3 using presigned URL's and I got to a point where I'm in doubt.

According to the S3:PutObject docs in order to specify SSE KMS Encryption I need to specify both:

  • x-amz-server-side-encryption: aws:kms
  • x-amz-server-side-encryption-aws-kms-key-id: SSEKMSKeyId

Particularly the latter one is documented as:

this header specifies the ID of the AWS Key Management Service

In my current use case, the value of x-amz-server-side-encryption-aws-kms-key-id HAS TO BE a full ARN as I'm dealing with cross-account bucket access.

I've always considered any Internal Identifier as a secret, but this piece of docs raises the following questions:

  • What are the implications of a leaked ARN?
  • Are AWS ARN's SAFE to include in headers as the documentation states?

As extra (maybe) useful info, I've ran an equivalent AWSCLI command for this operation in debug mode and this is a fragment of the full output:

2021-07-01 21:38:05,165 - ThreadPoolExecutor-0_0 - botocore.utils - DEBUG - Checking for DNS compatible bucket for: https://s3.%REGION%.amazonaws.com/%BUCKET_NAME%/sample_file.bin.2
2021-07-01 21:38:05,165 - ThreadPoolExecutor-0_0 - botocore.utils - DEBUG - Not changing URI, bucket is not DNS compatible: %BUCKET_NAME%
2021-07-01 21:38:05,166 - ThreadPoolExecutor-0_0 - botocore.auth - DEBUG - Calculating signature using v4 auth.
2021-07-01 21:38:05,166 - ThreadPoolExecutor-0_0 - botocore.auth - DEBUG - CanonicalRequest:
PUT /%BUCKET_NAME%/sample_file.bin.2

content-md5:XXXXXoXNw5aXreJi4EOxA==
content-type:application/octet-stream
host:s3.%REGION%.amazonaws.com
x-amz-acl:bucket-owner-full-control
x-amz-content-sha256:UNSIGNED-PAYLOAD
x-amz-date:%DATE%T193805Z
x-amz-server-side-encryption:aws:kms
x-amz-server-side-encryption-aws-kms-key-id:arn:aws:kms:%REGION:%ACCOUNT_NUMBER%:key/%KEY_ID%
content-md5;content-type;host;x-amz-acl;x-amz-content-sha256;x-amz-date;x-amz-server-side-encryption;x-amz-server-side-encryption-aws-kms-key-id
UNSIGNED-PAYLOAD
2021-07-01 21:38:05,166 - ThreadPoolExecutor-0_0 - botocore.auth - DEBUG - StringToSign:
AWS4-HMAC-SHA256
%DATE%T193805Z
%DATE%/%REGION%/s3/aws4_request
XXXXXXbdbe72de054b86a2ab9043d29132a37c10498546743fff9b941a325f89
2021-07-01 21:38:05,166 - ThreadPoolExecutor-0_0 - botocore.auth - DEBUG - Signature:
XXXXXXabd40e652756b2dfbc39a0b6c8f2a93fac6f6c8d0140829fb015ccad65
2021-07-01 21:38:05,166 - ThreadPoolExecutor-0_0 - botocore.hooks - DEBUG - Event request-created.s3.PutObject: calling handler <function signal_transferring at 0x7fc79472ebf8>
2021-07-01 21:38:05,166 - ThreadPoolExecutor-0_0 - botocore.endpoint - DEBUG - Sending http request: <AWSPreparedRequest stream_output=False, method=PUT, url=https://s3.%REGION%.amazonaws.com/%BUCKET_NAME%/sample_file.bin.2, headers={'x-amz-acl': b'bucket-owner-full-control', 'x-amz-server-side-encryption': b'aws:kms', 'x-amz-server-side-encryption-aws-kms-key-id': b'arn:aws:kms:%REGION:%ACCOUNT_NUMBER%:key/%KEY_ID%', 'Content-Type': b'application/octet-stream', 'User-Agent': b'aws-cli/1.16.261 Python/3.6.12 Linux/5.3.18-lp152.60-preempt botocore/1.15.38', 'Content-MD5': b'7XXXXXXNw5aXreJi4EOxA==', 'Expect': b'100-continue', 'X-Amz-Date': b'%DATE%T193805Z', 'X-Amz-Content-SHA256': b'UNSIGNED-PAYLOAD', 'Authorization': b'AWS4-HMAC-SHA256 Credential=XXXXXXXXXXXX/%DATE%/%REGION%/s3/aws4_request, SignedHeaders=content-md5;content-type;host;x-amz-acl;x-amz-content-sha256;x-amz-date;x-amz-server-side-encryption;x-amz-server-side-encryption-aws-kms-key-id, Signature=XXXXXXabd40e652756b2dfbc39a0b6c8f2a93fac6f6c8d0140829fb015ccad65', 'Content-Length': '1048576'}>

There I can see the full KMS ID in the headers...

P.S.: I've redacted most metadata & identifiers

1 Answer 1

4

It's definitely not a secret. While I wouldn't go handing my ARNs out on a street corner, they are safe to use in headers, etc.

A leaked ARN could be used by a third party to try perform actions on your resource, but because they exist outside of the resource's zone of trust they will be denied by default. The only way to change this is if YOU deploy resource policies that explicitly grant access to principals outside of the resource's zone.

In this scenario, the principal who you're attempting to grant s3:PutObject to will need to know the appropriate key name/alias to specify for encryption, otherwise you'll end up with objects in your bucket that you can't decrypt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.