Skip to content

Commit 79627df

Browse files
kessplaskessplas
committed
fix not-grep, prettier
1 parent 616da1e commit 79627df

File tree

2 files changed

+49
-41
lines changed

2 files changed

+49
-41
lines changed

‎s3-encryption/README.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
1-
# Amazon S3 Encryption Client v3 Specification
1+
[//]: # "Copyright Amazon.com Inc. or its affiliates. All Rights Reserved."
2+
[//]: # "SPDX-License-Identifier: CC-BY-SA-4.0"
23

3-
This specification applies to the S3 Encryption Client v3.
4+
# Amazon S3 Encryption Client v3 Specification
45

5-
The specification is based primarily on the Java implementation, which is considered authoritative in terms of functionality.
6+
This specification applies to the S3 Encryption Client v3.
67

8+
The specification is based primarily on the Java implementation, which is considered authoritative in terms of functionality.

‎s3-encryption/client.md

Lines changed: 44 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
[//]: # "Copyright Amazon.com Inc. or its affiliates. All Rights Reserved."
2+
[//]: # "SPDX-License-Identifier: CC-BY-SA-4.0"
3+
14
# Client
25

36
## Version
@@ -27,13 +30,13 @@ Depending on the language, this could be a builder (using the Builder pattern) o
2730

2831
## Overview
2932

30-
This document describes the top-level public S3 Encryption Client (S3EC).
33+
This document describes the top-level public S3 Encryption Client (S3EC).
3134
The S3EC provides client-side encryption for Amazon S3.
3235

3336
## AWS SDK Compatibility
3437

35-
The S3EC MUST adhere to the same interface for API operations as the conventional AWS SDK S3 client.
36-
In other words, the SDK's conventional S3 client is able to be substituted for the S3EC.
38+
The S3EC MUST adhere to the same interface for API operations as the conventional AWS SDK S3 client.
39+
In other words, the SDK's conventional S3 client is able to be substituted for the S3EC.
3740
The S3EC SHOULD support invoking operations unrelated to client-side encryption e.g. CopyObject as the conventional AWS SDK S3 client would.
3841
The S3EC MUST provide a different set of configuration options than the conventional S3 client.
3942

@@ -43,36 +46,36 @@ The S3EC MUST provide a different set of configuration options than the conventi
4346

4447
The S3EC MUST accept either one CMM or one Keyring instance upon initialization.
4548
If both a CMM and a Keyring are provided, the S3EC MUST throw an exception.
46-
When a Keyring is provided, the S3EC MUST create an instance of the DefaultCMM using the provided Keyring.
49+
When a Keyring is provided, the S3EC MUST create an instance of the DefaultCMM using the provided Keyring.
4750

48-
The S3EC MAY accept key material directly.
51+
The S3EC MAY accept key material directly.
4952
When only key material is provided, a Keyring corresponding to the type of key material is created by default.
50-
This behavior is discouraged, as it requires all Keyring configuration options to be supported by client initialization.
53+
This behavior is discouraged, as it requires all Keyring configuration options to be supported by client initialization.
5154
This leads to customer confusion when a Keyring is provided and a Keyring option is set on the client, and thus not applied.
52-
It is considered deprecated, meaning it will be removed in the next major version (v4).
55+
It is considered deprecated, meaning it will be removed in the next major version (v4).
5356

5457
### Options
5558

5659
#### Enable Legacy Wrapping Algorithms
5760

58-
The S3EC MUST support the option to enable or disable legacy wrapping algorithms.
59-
The option to enable legacy wrapping algorithms MUST be set to false by default.
61+
The S3EC MUST support the option to enable or disable legacy wrapping algorithms.
62+
The option to enable legacy wrapping algorithms MUST be set to false by default.
6063
When enabled, the S3EC MUST be able to decrypt objects encrypted with all supported wrapping algorithms (both legacy and fully supported).
6164
When disabled, the S3EC MUST NOT decrypt objects encrypted using legacy wrapping algorithms; it MUST throw an exception when attempting to decrypt an object encrypted with a legacy wrapping algorithm.
6265

6366
#### Enable Legacy Unauthenticated Modes
6467

6568
The S3EC MUST support the option to enable or disable legacy unauthenticated modes (content encryption algorithms).
66-
The option to enable legacy unauthenticated modes MUST be set to false by default.
69+
The option to enable legacy unauthenticated modes MUST be set to false by default.
6770
When enabled, the S3EC MUST be able to decrypt objects encrypted with all content encryption algorithms (both legacy and fully supported).
6871
When disabled, the S3EC MUST NOT decrypt objects encrypted using legacy content encryption algorithms; it MUST throw an exception when attempting to decrypt an object encrypted with a legacy content encryption algorithm.
6972

7073
#### Enable Delayed Authentication
7174

7275
The S3EC MUST support the option to enable or disable Delayed Authentication mode.
73-
Delayed Authentication mode MUST be set to false by default.
76+
Delayed Authentication mode MUST be set to false by default.
7477
When enabled, the S3EC MAY release plaintext from a stream which has not been authenticated.
75-
When disabled the S3EC MUST NOT release plaintext from a stream which has not been authenticated.
78+
When disabled the S3EC MUST NOT release plaintext from a stream which has not been authenticated.
7679

7780
#### Set Buffer Size
7881

@@ -92,45 +95,48 @@ In this case, the Instruction File Configuration SHOULD be optional, such that i
9295
### Inherited SDK Configuration
9396

9497
The S3EC MAY support directly configuring the wrapped SDK clients through its initialization.
95-
For example, the S3EC MAY accept a credentials provider instance during its initialization.
98+
For example, the S3EC MAY accept a credentials provider instance during its initialization.
9699
If the S3EC accepts SDK client configuration, the configuration MUST be applied to all wrapped S3 clients.
97100
If the S3EC accepts SDK client configuration, the configuration MUST be applied to all wrapped SDK clients including the KMS client.
98-
If the S3EC accepts any SDK client configuration options, then the S3EC should support all possible configuration options.
101+
If the S3EC accepts any SDK client configuration options, then the S3EC should support all possible configuration options.
99102

100103
### Other Dependencies
101104

102105
#### Randomness
103106

104107
The S3EC MAY accept a source of randomness during client initialization.
105-
The inclusion of a source of randomness is subject to language availability.
108+
The inclusion of a source of randomness is subject to language availability.
106109

107110
## API Operations
108111

109112
The S3EC must provide implementations for the following S3 operations:
110-
* GetObject MUST be implemented by the S3EC.
111-
* GetObject MUST decrypt data received from the S3 server and return it as plaintext.
112-
* PutObject MUST be implemented by the S3EC.
113-
* PutObject MUST encrypt its input data before it is uploaded to S3.
114-
* DeleteObject MUST be implemented by the S3EC.
115-
* DeleteObject MUST delete the given object key.
116-
* DeleteObject MUST delete the associated instruction file using the default instruction file suffix.
117-
* DeleteObjects MUST be implemented by the S3EC.
118-
* DeleteObjects MUST delete each of the given objects.
119-
* DeleteObjects MUST delete each of the corresponding instruction files using the default instruction file suffix.
113+
114+
- GetObject MUST be implemented by the S3EC.
115+
- GetObject MUST decrypt data received from the S3 server and return it as plaintext.
116+
- PutObject MUST be implemented by the S3EC.
117+
- PutObject MUST encrypt its input data before it is uploaded to S3.
118+
- DeleteObject MUST be implemented by the S3EC.
119+
- DeleteObject MUST delete the given object key.
120+
- DeleteObject MUST delete the associated instruction file using the default instruction file suffix.
121+
- DeleteObjects MUST be implemented by the S3EC.
122+
- DeleteObjects MUST delete each of the given objects.
123+
- DeleteObjects MUST delete each of the corresponding instruction files using the default instruction file suffix.
120124

121125
The S3EC may provide implementations for the following S3 operations:
122-
* CreateMultipartUpload MAY be implemented by the S3EC.
123-
* If implemented, CreateMultipartUpload MUST initiate a multipart upload.
124-
* UploadPart MAY be implemented by the S3EC.
125-
* UploadPart MUST encrypt each part.
126-
* Each part MUST be encrypted in sequence.
127-
* Each part MUST be encrypted using the same cipher instance for each part.
128-
* CompleteMultipartUpload MAY be implemented by the S3EC.
129-
* CompleteMultipartUpload MUST complete the multipart upload.
130-
* AbortMultipartUpload MAY be implemented by the S3EC.
131-
* AbortMultipartUpload MUST abort the multipart upload.
126+
127+
- CreateMultipartUpload MAY be implemented by the S3EC.
128+
- If implemented, CreateMultipartUpload MUST initiate a multipart upload.
129+
- UploadPart MAY be implemented by the S3EC.
130+
- UploadPart MUST encrypt each part.
131+
- Each part MUST be encrypted in sequence.
132+
- Each part MUST be encrypted using the same cipher instance for each part.
133+
- CompleteMultipartUpload MAY be implemented by the S3EC.
134+
- CompleteMultipartUpload MUST complete the multipart upload.
135+
- AbortMultipartUpload MAY be implemented by the S3EC.
136+
- AbortMultipartUpload MUST abort the multipart upload.
132137

133138
The S3EC may provide implementations for the following S3EC-specific operation(s):
134-
* ReEncryptInstructionFile MAY be implemented by the S3EC.
135-
* ReEncryptInstructionFile MUST decrypt the instruction file's encrypted data key for the given object using the client's CMM.
136-
* ReEncryptInstructionFile MUST re-encrypt the plaintext data key with a provided keyring.
139+
140+
- ReEncryptInstructionFile MAY be implemented by the S3EC.
141+
- ReEncryptInstructionFile MUST decrypt the instruction file's encrypted data key for the given object using the client's CMM.
142+
- ReEncryptInstructionFile MUST re-encrypt the plaintext data key with a provided keyring.

0 commit comments

Comments
 (0)