amazon s3 - AWS S3 SSE GetObject requires secret key -

the idea generate random key every file being uploaded, pass key s3 in order encrypt , store key in database. once user wants access file, key read database , passed s3 once again.

the first part works. objects uploaded , encrypted successfully, have issues retrieving them.

retrieving files request headers set:

when setting request headers such x-amz-server-side-encryption-customer-algorithm etc. when performing request resource, works, , able access it. since want these resources src <img>-tag, cannot perform requests require headers set.

thus, thought about:

pre signing urls:

to create pre signed url, built hmac sha1 of required string , used signature. calculated signature accepted s3 following error when requesting pre signed url:

requests specifying server side encryption customer provided keys must provide appropriate secret key.

the url has form:

https://s3-eu-west-1.amazonaws.com/bucket-id/resource-id?x-amz-server-side-encryption-customer-algorithm=aes256&awsaccesskeyid=myaccesskey&expires=1429939889&signature=generatedsignature 

the reason why error shown seems pretty clear me. @ no point in signing process encryption key used. thus, request cannot work. result, added encryption key base64, , md5 representation parameters url. url has following format:

https://s3-eu-west-1.amazonaws.com/bucket-id/resource-id?x-amz-server-side-encryption-customer-algorithm=aes256&awsaccesskeyid=myaccesskey&expires=1429939889&signature=generatedsignature&x-amz-server-side-encryption-customer-key=base64_key&x-amz-server-side-encryption-customer-key-md5=md5_key 

although key present (imho), same error message.

question know, how can access encrypted files get request not provide headers such x-amz-server-side-encryption-customer-algorithm?

it seems intuitive enough me trying should have worked.

apparently, though, when "headers"...

you must provide encryption headers in client application.

^{— http://docs.aws.amazon.com/amazons3/latest/dev/serversideencryptioncustomerkeys.html#sse-c-how-to-programmatically-intro}

... indeed mean headers , s3 doesn't accept these particular values when delivered part of query string, expect, since s3 flexible in regard.

i've tested this, , that's conclusion i've come to: doing isn't supported.

a get request x-amz-server-side-encryption-customer-algorithm=aes256 included in query string (and signature), along x-amz-server-side-encryption-customer-key , x-amz-server-side-encryption-customer-key-md5 headers work expected... believe you've discovered... putting key , key-md5 in query string, or without including in signature seems dead end.

it seemed strange, @ first, wouldn't allow in query string, since many other things allowed there... again, if you're going trouble of encrypting something, there seems little point in revealing encryption key in link... not mention key captured in s3 access logs, leaving encryption seeming pointless around -- , perhaps motivation requiring sent in headers , not query string.

based on i've found in testing, though, don't see way use encrypted objects customer-provided keys in hyperlinks, directly.

indirectly, of course, reverse proxy in front of s3 bucket translation you, taking appropriate values query string , placing them headers, instead... it's not clear me what's gained using customer-provided encryption keys downloadable objects, compared letting s3 handle at-rest encryption aws-managed keys. at-rest encryption you're getting either way.