PowerExchange for Amazon S3 User Guide

10.5
- 10.5.9
- 10.5.8
- 10.5.7
- 10.5.6
- 10.5.5
- 10.5.4
- 10.5.3
- 10.5.2
- 10.5.1
- 10.4.1
- 10.4.0

Back Next

Amazon S3 Data Encryption

To protect data, you can enable server-side encryption or client-side encryption to encrypt data inserted in Amazon S3 buckets.

You can encrypt data by using the master symmetric key or customer master key. Do not use the master symmetric key and customer master key together.

You can select type that you want to use to encrypt data in the

Encryption Type

advanced properties for the data object write operation. You can select the following encryption type you want to use to encrypt data:

None: The data is not encrypted.
Server Side Encryption: Select
Server Side Encryption
as the encryption type if you want Amazon S3 encrypts data using Amazon S3-managed encryption keys when you write the files to the target.
Server Side Encryption With KMS: If you select
Server Side Encryption With KMS
as the encryption type, the Unload command creates the staging files in the Amazon S3 bucket and Amazon S3 encrypts the file using AWS KMS-managed customer master key or Amazon Resource Name (ARN) for server-side encryption.; The AWS KMS-managed customer master key specified in the connection property must belong to the same region where Amazon S3 is hosted. For example, if Amazon S3 is hosted in the
US West (Oregon)
region, you must use the AWS KMS-managed customer master key enabled in the same region when you select the
Server Side Encryption With KMS
encryption type.

You cannot use the
Server Side Encryption With KMS
encryption type on MapR 6.1 distribution.
Client Side Encryption: Select
Client Side Encryption
as the encryption type if you want the Data Integration Service to encrypt the data when you write the files to the target. Client-side encryption uses a master symmetric key or customer master key that you specify in the Amazon S3 connection properties to encrypt data.
Applicable only when you run a mapping in the native environment.; If you specify both the master symmetric key and customer master key ID in the connection properties, and select a client-side encryption, the Data Integration Service uses the customer master key ID to encrypt data.; To enable client-side encryption, perform the following tasks:
Ensure that an organization administrator creates a master symmetric key or customer master key ID when you create an Amazon S3 connection.
The administrator user of the account can use the default customer master key ID to enable the client-side encryption.

Select
Client Side Encryption
as the encryption type in the advanced properties of the data object write operation.
Ensure that an organization administrator updates the security JAR files, required by the Amazon S3 client encryption policy, on the machine that hosts the Data Integration Service.

When you select a client-side encryption and run a mapping to read or write an Avro, ORC, or Parquet file, the mapping runs successfully. However, the Data Integration Service ignores the client-side encryption.