opensearch-project / opensearch-project/data-prepper
Support KMS encryption for SQS
@asifsmohammed is already working on this.
Since Mar 30, 2023.
- Dominant language
- Java
- Stars
- 374
- Forks
- 354
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 8
Description
Is your feature request related to a problem? Please describe.
SQS throws an AccessDeniedException when KMS SSE is enabled.
2023-03-23T06:56:51,165 [Thread-7] ERROR org.opensearch.dataprepper.plugins.source.SqsWorker - Error reading from SQS: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: b284a4f4-e245-4843-96dc-52922101df67; Proxy: null) (Service: Sqs, Status Code: 400, Request ID: 2f14d052-7b67-5e76-89a8-8cc7810c3906). Retrying with exponential backoff.
Describe the solution you'd like
I think having kms:decrypt permission should allow users to use encryption with SQS.
Additional context
Current permissions required to use S3 source with SQS.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "s3policy",
"Effect": "Allow",
"Action": [
"sqs:DeleteMessage",
"s3:GetObject",
"sqs:ReceiveMessage"
],
"Resource": "*"
}
]
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.