aws / aws/aws-extensions-for-dotnet-cli
Allow deploying to encrypted s3 folders
- Dominant language
- C#
- Stars
- 393
- Forks
- 90
- Avg merge
- 2d 19m
- Merged PRs (30d)
- 3
Description
Our company policy is that code deployments must be uploaded to a specific S3 bucket, which enforces encryption. In our dev account, we occasionally deploy lambdas and stacks via the AWS tools using visual studio / cli lambda tools.
Since encryption was enabled in S3, these manual deployments fail with error
`Error uploading to {path} in bucket {bucket}: Invalid keyId aws/s3`
There does not appear to be any way to allow enable this in `aws-lambda-tools-defaults.json` or elsewhere.
**Version**: Amazon Lambda Tools for .NET Core applications (3.2.3)
**To Reproduce**:
1. Create an S3 bucket manually and set encryption to AES256 or KMS
2. Create a AWS Serverless Application and set it up to deploy to the bucket
3. Deploy the function via AWS for Visual Studio or `dotnet lambda deploy-function`
It appears that Utilities.UploadToS3Async() needs to be changed to allow `ServerSideEncryptionMethod` and associated properties to be set in the PutObjectRequest, then passed through from `dotnet lambda deploy-function` and be configurable in `aws-lambda-tools-defaults.json`
Contributor guide
Research direction
Start by tracing Utilities.UploadToS3Async() and the dotnet lambda deploy-function entry point, then inspect how aws-lambda-tools-defaults.json settings reach the PutObjectRequest. Done means deployments can configure the requested S3 server-side encryption method and related properties for both AES256 and KMS buckets, and the documented reproduction succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, csharp
- Domain
- backend, cloud, devops
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100