使用客户端加密保护数据

以下代码示例演示了如何使用 Amazon KMS 和 Amazon SDK for Java 将对象上载到 Amazon S3。该示例使用 Amazon 托管密钥对客户端上的数据进行加密，然后再在将其上传到 Amazon S3 中。如果您已经有一个 KMS 密钥，则可通过在示例代码中指定 keyId 变量的值来使用该 CMK。如果您没有 KMS 密钥，或需要另一个，则可以通过 Java API 生成一个。示例代码会自动生成要使用的 KMS 密钥。

有关创建和测试有效示例的说明，请参阅 测试 Amazon S3 Java 代码示例。

        AWSKMS kmsClient = AWSKMSClientBuilder.standard()
                .withRegion(Regions.DEFAULT_REGION)
                .build();

        // create KMS key for for testing this example
        CreateKeyRequest createKeyRequest = new CreateKeyRequest();
        CreateKeyResult createKeyResult = kmsClient.createKey(createKeyRequest);

// --
        // specify an Amazon KMS key ID
        String keyId = createKeyResult.getKeyMetadata().getKeyId();

        String s3ObjectKey = "EncryptedContent1.txt";
        String s3ObjectContent = "This is the 1st content to encrypt";
// --

        AmazonS3EncryptionV2 s3Encryption = AmazonS3EncryptionClientV2Builder.standard()
                .withRegion(Regions.US_WEST_2)
                .withCryptoConfiguration(new CryptoConfigurationV2().withCryptoMode(CryptoMode.StrictAuthenticatedEncryption))
                .withEncryptionMaterialsProvider(new KMSEncryptionMaterialsProvider(keyId))
                .build();

        s3Encryption.putObject(bucket_name, s3ObjectKey, s3ObjectContent);
        System.out.println(s3Encryption.getObjectAsString(bucket_name, s3ObjectKey));

        // schedule deletion of KMS key generated for testing
        ScheduleKeyDeletionRequest scheduleKeyDeletionRequest =
                new ScheduleKeyDeletionRequest().withKeyId(keyId).withPendingWindowInDays(7);
        kmsClient.scheduleKeyDeletion(scheduleKeyDeletionRequest);

        s3Encryption.shutdown();
        kmsClient.shutdown();

以下代码示例演示如何执行这些任务：

有关创建和测试有效示例的说明，请参阅 测试 Amazon S3 Java 代码示例。

        KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
        keyGenerator.init(256);

// --
        // generate a symmetric encryption key for testing
        SecretKey secretKey = keyGenerator.generateKey();

        String s3ObjectKey = "EncryptedContent2.txt";
        String s3ObjectContent = "This is the 2nd content to encrypt";
// --

        AmazonS3EncryptionV2 s3Encryption = AmazonS3EncryptionClientV2Builder.standard()
                .withRegion(Regions.DEFAULT_REGION)
                .withClientConfiguration(new ClientConfiguration())
                .withCryptoConfiguration(new CryptoConfigurationV2().withCryptoMode(CryptoMode.AuthenticatedEncryption))
                .withEncryptionMaterialsProvider(new StaticEncryptionMaterialsProvider(new EncryptionMaterials(secretKey)))
                .build();

        s3Encryption.putObject(bucket_name, s3ObjectKey, s3ObjectContent);
        System.out.println(s3Encryption.getObjectAsString(bucket_name, s3ObjectKey));
        s3Encryption.shutdown();

以下代码示例演示如何执行这些任务：

有关创建和测试有效示例的说明，请参阅 测试 Amazon S3 Java 代码示例。

	        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
	        keyPairGenerator.initialize(2048);
	
	// --
	        // generate an asymmetric key pair for testing
	        KeyPair keyPair = keyPairGenerator.generateKeyPair();
	
	        String s3ObjectKey = "EncryptedContent3.txt";
	        String s3ObjectContent = "This is the 3rd content to encrypt";
	// --
	
	        AmazonS3EncryptionV2 s3Encryption = AmazonS3EncryptionClientV2Builder.standard()
	                .withRegion(Regions.US_WEST_2)
	                .withCryptoConfiguration(new CryptoConfigurationV2().withCryptoMode(CryptoMode.StrictAuthenticatedEncryption))
	                .withEncryptionMaterialsProvider(new StaticEncryptionMaterialsProvider(new EncryptionMaterials(keyPair)))
	                .build();
	
	        s3Encryption.putObject(bucket_name, s3ObjectKey, s3ObjectContent);
	        System.out.println(s3Encryption.getObjectAsString(bucket_name, s3ObjectKey));
	        s3Encryption.shutdown();