在服务器上对 Amazon S3 存储桶对象进行加密 - 适用于 Ruby 的 Amazon 开发工具包
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

在服务器上对 Amazon S3 存储桶对象进行加密

以下代码示例将加密对象添加到 Amazon S3 存储桶。通过使用 aws/s3 在服务器上执行加密Amazon托管客户主密钥 (CMK)。

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. # SPDX - License - Identifier: Apache - 2.0 require 'aws-sdk-s3' # Adds an encrypted object to an Amazon S3 bucket. The encryption is performed # on the server by using the aws/s3 AWS managed customer master key (CMK). # # Prerequisites: # # - An Amazon S3 bucket. # # @param s3_client [Aws::S3::Client] An initialized Amazon S3 client. # @param bucket_name [String] The name of the bucket. # @param object_key [String] The name to assign to the uploaded object. # @param content_to_encrypt [String] The content to be encrypted. # @return [Boolean] true if the encrypted object was successfully uploaded; # otherwise, false. # @example # exit 1 unless kms_sse_encrypted_object_uploaded?( # Aws::S3::Client.new(region: 'us-east-1'), # 'doc-example-bucket', # 'my-file.txt', # 'This is the content of my-file.txt.' # ) def kms_sse_encrypted_object_uploaded?( s3_client, bucket_name, object_key, content_to_encrypt ) s3_client.put_object( bucket: bucket_name, key: object_key, body: content_to_encrypt, server_side_encryption: 'aws:kms' ) return true rescue StandardError => e puts "Error uploading encrypted object: #{e.message}" return false end def run_me bucket_name = 'doc-example-bucket' object_key = 'my-file.txt' content_to_encrypt = 'This is the content of my-file.txt.' region = 'us-east-1' s3_client = Aws::S3::Client.new(region: region) if kms_sse_encrypted_object_uploaded?( s3_client, bucket_name, object_key, content_to_encrypt ) puts 'Encrypted object uploaded.' else puts 'Encrypted object not uploaded.' end end run_me if $PROGRAM_NAME == __FILE__