Skip to content

fix(s3): deprecate unencrypted encryption configuration for s3 bucket#24770

Merged
mergify[bot] merged 17 commits intoaws:mainfrom
clueleaf:feat/deprecate_unencrypted_s3_bucket
Apr 12, 2023
Merged

fix(s3): deprecate unencrypted encryption configuration for s3 bucket#24770
mergify[bot] merged 17 commits intoaws:mainfrom
clueleaf:feat/deprecate_unencrypted_s3_bucket

Conversation

@clueleaf
Copy link
Copy Markdown
Contributor

@clueleaf clueleaf commented Mar 23, 2023

S3 now applies SSE-S3 by default if server side encryption is not configured.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html

This PR simply deprecates UNENCRYPTED configuration of BucketEncryption, and changes some docs because they do not seem precise anymore.
Behavior of S3 bucket creation is not modified. Many other constructs create S3 buckets internally and updating all those related constructs will result in a huge impact.

This PR also deprecates TableEncryption.UNENCRYPTED of AWS Glue and creates an S3 bucket with S3_MANAGED if table encryption is not specified.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions Bot added the p2 label Mar 23, 2023
@aws-cdk-automation aws-cdk-automation requested a review from a team March 23, 2023 12:52
@github-actions github-actions Bot added the valued-contributor [Pilot] contributed between 6-12 PRs to the CDK label Mar 23, 2023
Copy link
Copy Markdown
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@clueleaf
Copy link
Copy Markdown
Contributor Author

Exemption Request
Integration test files are not modified because behavior is not changed.

@aws-cdk-automation aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Mar 23, 2023
@TheRealAmazonKendra
Copy link
Copy Markdown
Contributor

Exemption Request Integration test files are not modified because behavior is not changed.

Unfortunately, unless the tests are updated, the build will not pass so we cannot grant this exemption.

@TheRealAmazonKendra
Copy link
Copy Markdown
Contributor

Actually, in this case it's failing because the tests aren't using testDeprecated. For any tests within the S3 package, please use testDeprecated. For those that explicitly set BucketEncryption.UNENCRYPTED outside the package, please update to an appropriate value and/or leave that field unset.

@TheRealAmazonKendra TheRealAmazonKendra removed the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Mar 27, 2023
@aws-cdk-automation aws-cdk-automation dismissed their stale review March 28, 2023 02:20

✅ Updated pull request passes all PRLinter validations. Dissmissing previous PRLinter review.

@clueleaf
Copy link
Copy Markdown
Contributor Author

@TheRealAmazonKendra
Thank you for your guide. Now I am using testDeprecated for S3 unit tests with BucketEncryption.UNENCRYPTED.

I also deprecated TableEncryption.UNENCRYPTED of Glue service because users can explicitly specify S3 bucket encryption status.
For other services, removed BucketEncryption if it is set to UNENCRYPTED.

@aws-cdk-automation
Copy link
Copy Markdown
Collaborator

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

Comment thread packages/@aws-cdk/aws-glue/lib/table.ts Outdated
*/
export enum TableEncryption {
/**
* Previous option. Tables can not be unencrypted now.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that aws-glue is still alpha, we should consider removing this property altogether, so we don't carry this dead weight up to graduation.

I'd like to hear what other contributors think.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It sounds fair to me.
Waiting for some more comments and I'll proceed.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed on this.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed UNENCRYPTED property.

Comment thread packages/aws-cdk-lib/aws-cloudtrail/test/cloudtrail.test.ts Outdated
Comment thread packages/aws-cdk-lib/aws-cloudtrail/test/cloudtrail.test.ts Outdated
@mergify mergify Bot dismissed TheRealAmazonKendra’s stale review April 11, 2023 23:16

Pull request has been modified.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The behaviour of Bucket hasn't changed, so we shouldn't change the tests, either. If users pass UNENCRYPTED, we still want it to work the same way as before, which means we still need these tests in place.

Having said that, the test coverage for this feature has a lot of gaps, at the moment, such as the S3_MANAGED case. So, please either convert them to new test cases or don't modify the tests at all (apart from replacing test with testDeprecated where appropriate).

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. Modified S3_MANAGED tests to new test cases.

Copy link
Copy Markdown
Contributor

@otaviomacedo otaviomacedo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @clueleaf. I think we're almost there. Just check out my comment about the unit tests, which I didn't catch in the first pass.

@mergify mergify Bot dismissed otaviomacedo’s stale review April 12, 2023 12:50

Pull request has been modified.

@clueleaf clueleaf requested a review from otaviomacedo April 12, 2023 13:25
@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Apr 12, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Copy Markdown
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: fc910fc
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify Bot merged commit b971615 into aws:main Apr 12, 2023
@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Apr 12, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@clueleaf clueleaf deleted the feat/deprecate_unencrypted_s3_bucket branch April 13, 2023 02:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

p2 valued-contributor [Pilot] contributed between 6-12 PRs to the CDK

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants