opensearch-project / opensearch-project/data-prepper

Support KMS encryption for SQS

Open
#2,422 1 comment 0 reactions 1 assignee View on GitHub

@asifsmohammed is already working on this.

Since Mar 30, 2023.

documentation
Dominant language
Java
Stars
374
Forks
354
Avg merge
3d 18h
Merged PRs (30d)
8

Description

Is your feature request related to a problem? Please describe.
SQS throws an AccessDeniedException when KMS SSE is enabled.

2023-03-23T06:56:51,165 [Thread-7] ERROR org.opensearch.dataprepper.plugins.source.SqsWorker - Error reading from SQS: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: b284a4f4-e245-4843-96dc-52922101df67; Proxy: null) (Service: Sqs, Status Code: 400, Request ID: 2f14d052-7b67-5e76-89a8-8cc7810c3906). Retrying with exponential backoff.

Describe the solution you'd like
I think having kms:decrypt permission should allow users to use encryption with SQS.

Additional context
Current permissions required to use S3 source with SQS.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "s3policy",
            "Effect": "Allow",
            "Action": [
                "sqs:DeleteMessage",
                "s3:GetObject",
                "sqs:ReceiveMessage"
            ],
            "Resource": "*"
        }
    ]
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.