Skip to content

Add S3 server side encryption settings

Stan Hu requested to merge sh-add-s3-storage-options into master

Prior to this change, uploads to AWS S3 were only encrypted on the server if a default encryption were specified on the bucket.

With this change, admins can now configure the encryption and the AWS Key Management Service (KMS) key ID, and the configuration will be used in uploads. Bucket policies to enforce encryption can now be used since Workhorse sends the required headers (x-amz-server-side-encryption and x-amz-server-side-encryption-aws-kms-key-id). The bucket policy cannot be enforced with default encryption, since that is applied after the check.

Related merge requests:

  1. gitlab-org/gitlab!38240 (merged)
  2. gitlab-org/gitlab-workhorse!537 (merged)

Part of gitlab-org/gitlab#22200 (closed)

Relates to #1012 (closed)

Edited by Stan Hu

Merge request reports