使用私有密钥对 Amazon S3 存储桶对象进行解密 - 适用于 Ruby 的 Amazon 开发工具包
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

使用私有密钥对 Amazon S3 存储桶对象进行解密

以下代码示例从 Amazon S3 存储桶下载数据元。对象的内容最初是使用 RSA 公钥加密的。

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. # SPDX - License - Identifier: Apache - 2.0 require 'aws-sdk-s3' require 'openssl' # Downloads an object from an Amazon S3 bucket. The object's contents # were originally encrypted with an RSA public key. # # Prerequisites: # # - An Amazon S3 bucket. # - An object in this bucket. # # @param s3_encryption_client [Aws::S3::EncryptionV2::Client] An initialized # Amazon S3 encryption client. # @param bucket_name [String] The bucket's name. # @param object_key [String] The name of the object. # @return [String] The object's content; otherwise, information about the # failed download operation. # @example # puts download_object_with_private_key_encryption( # Aws::S3::EncryptionV2::Client.new( # encryption_key: OpenSSL::PKey::RSA.new(File.read('my-private-key.pem')), # key_wrap_schema: :rsa_oaep_sha1, # content_encryption_schema: :aes_gcm_no_padding, # security_profile: :v2, # region: 'us-east-1' # ), # 'doc-example-bucket', # 'my-file.txt' # ) def download_object_with_private_key_encryption( s3_encryption_client, bucket_name, object_key ) response = s3_encryption_client.get_object( bucket: bucket_name, key: object_key ) return response.body.read rescue StandardError => e puts "Error downloading object: #{e.message}" end # Full example call: # Prerequisites: the same RSA key pair you originally used to encrypt the object. def run_me bucket_name = 'doc-example-bucket' object_key = 'my-file.txt' region = 'us-east-1' private_key_file = 'my-private-key.pem' private_key = OpenSSL::PKey::RSA.new(File.read(private_key_file)) # When initializing this Amazon S3 encryption client, note: # - For key_wrap_schema, use rsa_oaep_sha1 for asymmetric keys. # - For security_profile, for reading or decrypting objects encrypted # by the v1 encryption client, use :v2_and_legacy instead. s3_encryption_client = Aws::S3::EncryptionV2::Client.new( encryption_key: private_key, key_wrap_schema: :rsa_oaep_sha1, content_encryption_schema: :aes_gcm_no_padding, security_profile: :v2, region: region ) puts "The content of '#{object_key}' in bucket '#{bucket_name}' is:" puts download_object_with_private_key_encryption( s3_encryption_client, bucket_name, object_key ) end run_me if $PROGRAM_NAME == __FILE__