plugin-cloud-storage: S3 KMS encryption not supported

[jakub-pietrzak]

The plugin does not seem to support uploads into S3 buckets that have SSE KMS encryption enabled.

I had to explicitly override the logic for getHandleUpload function.

    const kmsKeyId = process.env.S3_KMS_KEY_ID
    const sse = kmsKeyId ? ServerSideEncryption.aws_kms : ServerSideEncryption.AES256

    if (file.buffer.length > 0 && file.buffer.length < multipartThreshold) {
      await getStorageClient().putObject({
        Bucket: bucket,
        Key: fileKey,
        Body: fileBufferOrStream,
        ACL: acl,
        ServerSideEncryption: sse, // new param
        SSEKMSKeyId: kmsKeyId, // new param
        ContentType: file.mimeType
      })

      return data
    }

That KMS key is set as a default encryption key for the bucket, I'm not sure if it matters, though.

[paulpopus]

This plugin is now being maintained in the Packages Directory of the Payload Monorepo. This repo will soon be archived and all open issues will be closed. This issue, however, will be transferred over.

[denolfe]

Moving this to Discussions as a feature request.