Question

我尝试使用AWS RDS Aurora功能SELECT * INTO OUTFILE S3 :some_bucket/object_key，其中some_bucket默认服务器端加密KMS。

我收到此错误，这是有道理的：

InternalError: (InternalError) (1871, u'S3 API returned error: Unknown:Unable to parse ExceptionName: KMS.NotFoundException Message: Invalid keyId')

如何使这项工作成功，让Aurora拥有KMS密钥，以便将文件上传到S3？

Answer 1

根据文档

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.SaveIntoS3.html#AuroraMySQL.Integrating.SaveIntoS3.Statement

不支持压缩或加密文件。

但是您可以使用特定后缀的“ NotResource”策略为存储桶创建一个例外策略，然后从中选择一个例外策略，从那里您可以触发一个lambda来通过加密将文件移动到实际路径。

Answer 2

Aurora MySQL当前支持此功能。请按照上述官方文档为您的RDS群集添加IAM角色，并确保该角色具有同时授予S3读/写和KMS加密/解密权限的策略，例如

        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:ListMultipartUploadParts",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::<bucket-name>/*"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::<bucket-name>"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "kms:ReEncrypt*",
                "kms:Encrypt",
                "kms:DescribeKey",
                "kms:Decrypt",
                "kms:GenerateDataKey*"
            ],
            "Resource": "arn:aws:kms:<region>:<account>:key/<key id>"
        }

使用KMS将AWS RDS Aurora选择为S3加密存储桶

2 个答案: