0

I want to download a file from an encypted bucket in s3. The bucket is encrypted using AES256. I am using the following command

s3cmd --access_key=<access_key> --secret_key=<secret_key> get <s3_key_location> <target_loc>.

I read the s3 usage. It did not help much.

How do I specify the option that I want to download the file after decryption from s3?

Also since the bucket is encrypted, this command creates a dummy file with the same name as the key present in the s3 location having a size 0 in the target location.

One important thing to note here is that I am using boto to run the s3cmd commands.

s3cmd version 1.5.2

Nitin Pandey
  • 649
  • 1
  • 9
  • 27

3 Answers3

0

Why don't you use aws command line? I guess it has better support with encrypted s3 bucket.

e.g. aws s3 cp <s3_path> <local_path>

https://aws.amazon.com/cli/

Tommy
  • 7,400
  • 4
  • 30
  • 26
  • I am executing this command via a python code. I have a list of files to be copied, so cannot use CLI. – Nitin Pandey Oct 27 '15 at 08:09
  • @psycho: The [AWS Command-Line Interface (CLI)](http://aws.amazon.com/cli/) is an app just like `s3cmd`, so if you can use that, then you can also use the CLI. If you wish to incorporate commands within your Python code, use `boto`. – John Rotenstein Oct 29 '15 at 15:12
0

So along with this optional parameter --server-side-encryption you have to give the encryption paraphrase while configuring the s3cmd.

Unfortunately , I did not find any parameter in the s3cmd command which can override the value specified in the encryption paraphrase. There are a couple of ways with which you can configure the encryption paraphase :

1.using the s3cmd --configure option

2.Modifying the .s3cfg config file present in the home directory.

I was looking for a parameter which can override the value given in the config file.

Example : If the access key in the file is A and while running the s3cmd I specify --access_key B. The value A will not be used for the s3cmd for that command execution , however the value A will always be used when we are not specifying the access key. So If there is any parameter for encryption paraphase also , please post that here.

Nitin Pandey
  • 649
  • 1
  • 9
  • 27
0

Amazon S3 objects encrypted with server side encryption are automatically decrypted when they are retrieved. The encryption affects how the data is stored on disk but you will never see encrypted objects.

Therefore, just download the file as normal.

By the way, these days it is preferable to use the AWS Command-Line Interface (CLI) rather than s3cmd.

If you wish to download via Python, use the boto function: get_contents_to_file()

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470