GCP: Support CMEK (kms-key-name) for GCS server-side encryption - #18151
munendrasn wants to merge 1 commit into
Conversation
GCSOutputStream previously supported only CSEK (gcs.encryption-key), where the raw key is sent to GCS on every request. This adds CMEK support via a new gcs.kms-key-name property: the caller passes only the Cloud KMS key resource name, and GCS performs encryption/decryption server-side, so the caller's credentials need no KMS permission. The write path emits BlobWriteOption.kmsKeyName(...) when the property is set; reads require no change since CMEK decryption is automatic. CSEK and CMEK are mutually exclusive (GCS rejects both on one object), enforced at property-parse time with a fail-fast Preconditions check.
amlel-el-mahrouss
left a comment
amlel-el-mahrouss
left a comment
There was a problem hiding this comment.
LGTM. Correct practices were done here.
singhpk234
left a comment
singhpk234
left a comment
There was a problem hiding this comment.
The change LGTM, just want to have more eyes on config names !
| /** | ||
| * Cloud KMS key resource name for CMEK server-side encryption. Mutually exclusive with {@link | ||
| * #GCS_ENCRYPTION_KEY} (CSEK). | ||
| */ | ||
| public static final String GCS_KMS_KEY_NAME = "gcs.kms-key-name"; |
There was a problem hiding this comment.
i would really like them to be prefixed with sse ...
like s3 does, s3.sse.<>
this will get more and more tricky as we CSE in... but we already have the key named this way
let me add some folks from google in this thread as well, if they have better suggestion on the name !
There was a problem hiding this comment.
Thanks @singhpk234 for the review. On the naming, I used current naming in gcp as reference
encryptionKey is named as gcp.encryption-key and same for decryptionKey.
I can rename to follow aws s3 naming convention, if we are aligned
|
cc @talatuyarer |
3 participants
Currently, GCS supports only CSEK. The user can configure
gcs.encryption-key, where the raw key is sent to GCS on every request.This PR adds CMEK support via a new
gcs.kms-key-nameproperty, the caller passes only the Cloud KMS key resource name, and GCS performs encryption/decryption server-side.The reads require no change since CMEK decryption is automatic. CSEK and CMEK are mutually exclusive (GCS rejects both on one object), enforced at property-parse time with a fail-fast Preconditions check.