fix(storage): fix upload object with bucket cmek enabled #158
Conversation
googlebot
added
the
cla: yes
There was a problem hiding this comment.
Thanks @HemangChothani, I have one request, but otherwise LGTM.
| if self.kms_key_name is not None: | ||
| if ( | ||
| self.kms_key_name is not None | ||
| and "cryptoKeyVersions" not in self.kms_key_name |
There was a problem hiding this comment.
Please add comments on why this is needed for posterity. Mainly that Cloud Storage object metadata stores kmsKeyName with version information and uploads() expect non-versioned information.
google/cloud/storage/blob.py
Outdated
| # When cmek is enabled for bucket blob.metadata stores the value of | ||
| # kmsKeyName with version information whereas upload method expect | ||
| # information without version so this condition ignores the kmsKeyName | ||
| # which has cryptoKeyVersions. |
There was a problem hiding this comment.
Suggested changes:
When a Customer Managed Encryption Key is used to encrypt Cloud Storage object at rest, object resource metadata will store the version of the Key Management Service cryptographic material. If a Blob instance with KMS Key metadata set is used to upload a new version of the object then the existing kmsKeyName version value can't be used in the upload request and the client instead ignores it.
Fixes #155