Node.js implementation of the KMS Envelope Encryption for AWS S3
npm install node-s3-encryption-clientThe Amazon S3 Encryption Client (http://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html#sse-client)
currently only exists for Java and Ruby. This library implements KMS envelope encryption
(http://docs.aws.amazon.com/kms/latest/developerguide/workflow.html) for Javascript, adding
an option to choose the cipher algorithm and the S3 objects encoding. It exposes getObject and putObject
from the AWS S3 client, with KMS encryption options for client-side encryption.
#### EncryptionContext
Same as the EncryptionContext property here: http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/KMS.html#generateDataKey-property
Must be specified for decryption (i.e. getObject) if it was specified during encryption (i.e. putObject).
#### KmsParams
A JSON document matching the params here: http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/KMS.html#generateDataKey-property
At the very least, KmaParams.KeyId must be defined in order for encryption to happen. Note that, per AWS documentation,
either NumberOfBytes or KeySpec is required in addition to KeyId. Also note that if an EncryptionContext is given,
it must also be specified in the call to getObject.
#### CipherAlgorithm
The cipher algorithm to use when encrypting the object. Find the list by looking at crypto.getCiphers(). Optional,
will be ignored if KmsKeyId is missing.
#### DecryptedEncoding
The character encoding of the file to be uploaded to S3, to be used when encrypting (and thus decrypting) the
object. Optional, will be ignored if KmsKeyId is missing.
To encrypt:
1. Create a KMS key (it is assumed that you have already done this)
2. Use the key from #1 to generate a KMS Data Key
3. Use the KMS Data Key's Plaintext to encrypt your file
4. Put the file into S3 with the KMS Data Key's CiphertextBlob in the object's Metadata
5. Also include the cipher algorithm and decrypted encoding in the object's Metadata
To decrypt:
1. Get the object
2. Get the CiphertextBlob from the object's Metadata
3. Decrypt the CiphertextBlob using the KMS library (don't need the original KMS KeyId)
4. Use the decrypted key plus the cipher algorithm and decrypted encoding (from the Metadata)
to decrypt the object content
Since you sometimes need to manually upload encrypted objects to S3 manually (i.e. not using this library), there
is a bash script included in the /bin folder that performs the "To encrypt" steps above:
s3-put-encrypted.
Licensed under the Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0