fix(s3): bucketKey does not support SSE-S3

packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/aws-cdk-s3-bucket-encryption.template.json

@@ -15,6 +15,23 @@
  },
  "UpdateReplacePolicy": "Retain",
  "DeletionPolicy": "Retain"
+ },
+ "MySSES3Bucket6973690D": {
+ "Type": "AWS::S3::Bucket",
+ "Properties": {
+ "BucketEncryption": {
+ "ServerSideEncryptionConfiguration": [
+ {
+ "BucketKeyEnabled": true,
+ "ServerSideEncryptionByDefault": {
+ "SSEAlgorithm": "AES256"
+ }
+ }
+ ]
+ }
+ },
+ "UpdateReplacePolicy": "Retain",
+ "DeletionPolicy": "Retain"
  }
  },
  "Parameters": {

packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.ts

@@ -10,6 +10,11 @@ new s3.Bucket(stack, 'MyDSSEBucket', {
  encryption: s3.BucketEncryption.DSSE_MANAGED,
 });
 
+new s3.Bucket(stack, 'MySSES3Bucket', {
+ encryption: s3.BucketEncryption.S3_MANAGED,
+ bucketKeyEnabled: true,
+});
+
 new integ.IntegTest(app, 'IntegTestDSSEBucket', {
  testCases: [stack],
 });

packages/aws-cdk-lib/aws-s3/lib/bucket.ts

@@ -1440,7 +1440,7 @@ export interface BucketProps {
  * attendant cost implications of that).
  * - If enabled, S3 will use its own time-limited key instead.
  *
- * Only relevant, when Encryption is set to `BucketEncryption.KMS` or `BucketEncryption.KMS_MANAGED`.
+ * Only relevant, when Encryption is not set to `BucketEncryption.UNENCRYPTED`.
  *
  * @default - false
  */
@@ -2105,6 +2105,7 @@ export class Bucket extends BucketBase {
  * | KMS | undefined | e | SSE-KMS, bucketKeyEnabled = e | new key |
  * | KMS_MANAGED | undefined | e | SSE-KMS, bucketKeyEnabled = e | undefined |
  * | S3_MANAGED | undefined | false | SSE-S3 | undefined |
+ * | S3_MANAGED | undefined | e | SSE-S3, bucketKeyEnabled = e | undefined |
  * | UNENCRYPTED | undefined | true | ERROR! | ERROR! |
  * | UNENCRYPTED | k | e | ERROR! | ERROR! |
  * | KMS_MANAGED | k | e | ERROR! | ERROR! |
@@ -2127,12 +2128,9 @@ export class Bucket extends BucketBase {
  throw new Error(`encryptionKey is specified, so 'encryption' must be set to KMS or DSSE (value: ${encryptionType})`);
  }
 
- // if bucketKeyEnabled is set, encryption must be set to KMS or DSSE.
- if (
- props.bucketKeyEnabled &&
- ![BucketEncryption.KMS, BucketEncryption.KMS_MANAGED, BucketEncryption.DSSE, BucketEncryption.DSSE_MANAGED].includes(encryptionType)
- ) {
- throw new Error(`bucketKeyEnabled is specified, so 'encryption' must be set to KMS or DSSE (value: ${encryptionType})`);
+ // if bucketKeyEnabled is set, encryption can not be BucketEncryption.UNENCRYPTED
+ if (props.bucketKeyEnabled && encryptionType === BucketEncryption.UNENCRYPTED) {
+ throw new Error(`bucketKeyEnabled is specified, so 'encryption' must be set to KMS, DSSE or S3 (value: ${encryptionType})`);
  }
 
  if (encryptionType === BucketEncryption.UNENCRYPTED) {
@@ -2161,7 +2159,10 @@ export class Bucket extends BucketBase {
  if (encryptionType === BucketEncryption.S3_MANAGED) {
  const bucketEncryption = {
  serverSideEncryptionConfiguration: [
- { serverSideEncryptionByDefault: { sseAlgorithm: 'AES256' } },
+ {
+ bucketKeyEnabled: props.bucketKeyEnabled,
+ serverSideEncryptionByDefault: { sseAlgorithm: 'AES256' },
+ },
  ],
  };
 

packages/aws-cdk-lib/aws-s3/test/bucket.test.ts

@@ -574,15 +574,41 @@ describe('bucket', () => {
  });
  });
 
- test('throws error if bucketKeyEnabled is set, but encryption is not KMS', () => {
+ test('bucketKeyEnabled can be enabled with SSE-S3', () => {
  const stack = new cdk.Stack();
 
+ // WHEN
+ new s3.Bucket(stack, 'MyBucket', { bucketKeyEnabled: true, encryption: s3.BucketEncryption.S3_MANAGED });
+ Template.fromStack(stack).hasResourceProperties('AWS::S3::Bucket', {
+ BucketEncryption: {
+ ServerSideEncryptionConfiguration: [
+ {
+ ServerSideEncryptionByDefault: { SSEAlgorithm: 'AES256' },
+ BucketKeyEnabled: true,
+ },
+ ],
+ },
+ });
+
+ });
+ test('bucketKeyEnabled can not be enabled with UNENCRYPTED', () => {
+ const stack = new cdk.Stack();
+
+ // WHEN
  expect(() => {
- new s3.Bucket(stack, 'MyBucket', { bucketKeyEnabled: true, encryption: s3.BucketEncryption.S3_MANAGED });
- }).toThrow("bucketKeyEnabled is specified, so 'encryption' must be set to KMS or DSSE (value: S3_MANAGED)");
+ new s3.Bucket(stack, 'MyBucket', {
+ bucketKeyEnabled: true,
+ encryption: s3.BucketEncryption.UNENCRYPTED,
+ });
+ }).toThrow(/bucketKeyEnabled is specified, so 'encryption' must be set to KMS, DSSE or S3/);
+ });
+
+ test('bucketKeyEnabled can NOT be enabled with encryption undefined', () => {
+ const stack = new cdk.Stack();
+
  expect(() => {
  new s3.Bucket(stack, 'MyBucket3', { bucketKeyEnabled: true });
- }).toThrow("bucketKeyEnabled is specified, so 'encryption' must be set to KMS or DSSE (value: UNENCRYPTED)");
+ }).toThrow("bucketKeyEnabled is specified, so 'encryption' must be set to KMS, DSSE or S3 (value: UNENCRYPTED)");
 
  });