name property as
+ * a collection of pair of Strings, trimmed of the leading and trailing whitespace
+ * after delimiting the name by comma and new line separator.
+ * If no such property is specified then empty Map is returned.
+ *
+ * @param valueString the string containing the key-value pairs.
+ * @return property value as a Map of Strings, or empty
+ * Map.
+ */
+ public static Map+ * http://www.apache.org/licenses/LICENSE-2.0 + *
+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.hadoop.fs.s3a; + +import java.io.IOException; +import java.io.UncheckedIOException; +import java.util.Set; + +import org.apache.hadoop.thirdparty.com.google.common.collect.ImmutableSet; + +import org.apache.commons.lang.StringUtils; +import org.apache.hadoop.conf.Configuration; +import org.apache.hadoop.fs.s3a.impl.S3AEncryption; + +import static org.apache.hadoop.fs.contract.ContractTestUtils.skip; +import static org.apache.hadoop.fs.s3a.Constants.S3_ENCRYPTION_CONTEXT; +import static org.apache.hadoop.fs.s3a.Constants.S3_ENCRYPTION_KEY; +import static org.apache.hadoop.fs.s3a.S3AEncryptionMethods.DSSE_KMS; +import static org.apache.hadoop.fs.s3a.S3AEncryptionMethods.SSE_KMS; +import static org.apache.hadoop.fs.s3a.S3ATestUtils.assume; +import static org.apache.hadoop.fs.s3a.S3ATestUtils.getTestBucketName; + +/** + * Concrete class that extends {@link AbstractTestS3AEncryption} + * and tests KMS encryption with encryption context. + * S3's HeadObject doesn't return the object's encryption context. + * Therefore, we don't have a way to assert its value in code. + * In order to properly test if the encryption context is being set, + * the KMS key or the IAM User need to have a deny statements like the one below in the policy: + *
+ * {
+ * "Effect": "Deny",
+ * "Principal": {
+ * "AWS": "*"
+ * },
+ * "Action": "kms:Decrypt",
+ * "Resource": "*",
+ * "Condition": {
+ * "StringNotEquals": {
+ * "kms:EncryptionContext:project": "hadoop"
+ * }
+ * }
+ * }
+ *
+ * With the statement above, S3A will fail to read the object from S3 if it was encrypted
+ * without the key-pair "project": "hadoop" in the encryption context.
+ */
+public class ITestS3AEncryptionSSEKMSWithEncryptionContext
+ extends AbstractTestS3AEncryption {
+
+ private static final Set+ * http://www.apache.org/licenses/LICENSE-2.0 + *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.fs.s3a.impl;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.Assert;
+import org.junit.Test;
+
+import org.apache.commons.codec.binary.Base64;
+import org.apache.hadoop.conf.Configuration;
+
+import static org.apache.hadoop.fs.s3a.Constants.S3_ENCRYPTION_CONTEXT;
+
+public class TestS3AEncryption {
+
+ private static final String GLOBAL_CONTEXT = " project=hadoop, jira=HADOOP-19197 ";
+ private static final String BUCKET_CONTEXT = "component=fs/s3";
+
+ @Test
+ public void testGetS3EncryptionContextPerBucket() throws IOException {
+ Configuration configuration = new Configuration(false);
+ configuration.set("fs.s3a.bucket.bucket1.encryption.context", BUCKET_CONTEXT);
+ configuration.set(S3_ENCRYPTION_CONTEXT, GLOBAL_CONTEXT);
+ final String result = S3AEncryption.getS3EncryptionContext("bucket1", configuration);
+ Assert.assertEquals(BUCKET_CONTEXT, result);
+ }
+
+ @Test
+ public void testGetS3EncryptionContextFromGlobal() throws IOException {
+ Configuration configuration = new Configuration(false);
+ configuration.set("fs.s3a.bucket.bucket1.encryption.context", BUCKET_CONTEXT);
+ configuration.set(S3_ENCRYPTION_CONTEXT, GLOBAL_CONTEXT);
+ final String result = S3AEncryption.getS3EncryptionContext("bucket2", configuration);
+ Assert.assertEquals(GLOBAL_CONTEXT.trim(), result);
+ }
+
+ @Test
+ public void testGetS3EncryptionContextNoSet() throws IOException {
+ Configuration configuration = new Configuration(false);
+ final String result = S3AEncryption.getS3EncryptionContext("bucket1", configuration);
+ Assert.assertEquals("", result);
+ }
+
+ @Test
+ public void testGetS3EncryptionContextBase64Encoded() throws IOException {
+ Configuration configuration = new Configuration(false);
+ configuration.set(S3_ENCRYPTION_CONTEXT, GLOBAL_CONTEXT);
+ final String result = S3AEncryption.getS3EncryptionContextBase64Encoded("bucket",
+ configuration, true);
+ final String decoded = new String(Base64.decodeBase64(result), StandardCharsets.UTF_8);
+ final TypeReference