Add default encryption KMS to bucket programmatically - ios

Question

I am adding KMS (SSE-KMS) encryption to an AWS S3 bucket programmatically using the AWS SDK iOS v2.6.21. I do this with the following objective-c code:
AWSS3 *awsClient = [AWSS3 S3ForKey:bucketObject.regionShortName];
AWSS3ServerSideEncryptionRule *rule= [AWSS3ServerSideEncryptionRule new];
AWSS3ServerSideEncryptionByDefault *applyServerSideEncryptionByDefault =[AWSS3ServerSideEncryptionByDefault new];applyServerSideEncryptionByDefault.SSEAlgorithm=AWSS3ServerSideEncryptionAwsKms;
applyServerSideEncryptionByDefault.KMSMasterKeyID=kmsAliasKeyId;
AWSS3ServerSideEncryptionConfiguration *configuration =
[AWSS3ServerSideEncryptionConfiguration new];
configuration.rules = #[rule];
AWSS3PutBucketEncryptionRequest *request =
[AWSS3PutBucketEncryptionRequest new];
request.bucket = bucketObject.name;
request.serverSideEncryptionConfiguration=configuration;
[awsClient putBucketEncryption:request];
}
This seemingly works and shows my bucket having default encryption. However, it does not specify that the encryption is KMS, it just shows a checkmark that encryption is on (when looking at the console).
When I programmatically check the status of the encryption it does not specify anything for SSEAlgorithm:
<AWSS3ServerSideEncryptionConfiguration: 0x604000008790> {
rules = (
"<AWSS3ServerSideEncryptionRule: 0x6040000087f0> {\n}"
);
}
I would expect the output showing SSEAlgorithm to be 2 based on how AWSS3ServerSideEncryption is defined in AWS SDK:
AWSS3ServerSideEncryption:
AWSS3ServerSideEncryptionUnknown,
AWSS3ServerSideEncryptionAES256,
AWSS3ServerSideEncryptionAwsKms,
When I compare the output when I do the same code using SSE-S3 (AWSS3ServerSideEncryptionAES256) instead and the output is:
<AWSS3ServerSideEncryptionConfiguration: 0x600000009c40> {
rules = (
"<AWSS3ServerSideEncryptionRule: 0x600000009c50> {\n
applyServerSideEncryptionByDefault = \"<AWSS3ServerSideEncryptionByDefault: 0x60000022b6a0> {\\n SSEAlgorithm = 1;\\n}\";\n}"
);
}
Can anyone see what I am missing in my request to correctly use KMS as the default encryption for the entire bucket?
Thanks. Cheers, Trond

Answer 1

You have setup all the objects correctly, expect for the step where you associate the encryption on the rule. See the code below for the change you need to make to get it setup correctly.
...
...
...
AWSS3ServerSideEncryptionRule *rule= [AWSS3ServerSideEncryptionRule new];
AWSS3ServerSideEncryptionByDefault *applyServerSideEncryptionByDefault =[AWSS3ServerSideEncryptionByDefault new];
applyServerSideEncryptionByDefault.SSEAlgorithm=AWSS3ServerSideEncryptionAwsKms;
applyServerSideEncryptionByDefault.KMSMasterKeyID=kmsAliasKeyId;
//Add the encryption information to the rule
rule.applyServerSideEncryptionByDefault = applyServerSideEncryptionByDefault;
AWSS3ServerSideEncryptionConfiguration *configuration =
...
...
...