Download and decrypt encrypted AWS CloudTrail log in the bucket

Question

I am trying to download CloudTrail's log file that is stored in a S3 bucket but when I received the file it is unreadable until I realize that it could be encrypted as per say here and I don't know how to decrypt the file.

Here is my code:

 AWSCredentials credentials  = new BasicAWSCredentials(prop.getProperty("provider.aws01.username"), prop.getProperty("provider.aws01.password"));
          s3client = new AmazonS3Client(credentials);
       S3Object s3object = s3client.getObject(new GetObjectRequest(
                bucketName, "examplecloudtraillog.json.gz"));
           System.out.println("Encrypted with: "  + 
                s3object.getObjectMetadata().getSSEAlgorithm());
          InputStream is = s3object.getObjectContent();
          OutputStream outputStream =
                    new FileOutputStream(new File("test.txt"));

        int read = 0;
        byte[] bytes = new byte[1024];

        while ((read = is.read(bytes)) != -1) {
            outputStream.write(bytes, 0, read);
        }

        System.out.println("Done!");

And when i received the file it looks like gibberish, here is the output file:

‹       ÅUÛ²¢Xý•
_OQr¿øxDÅž‰Ž
{£ÈU6 Xqþ½Ásº«ººª§f¢#&‚13W^ȵòóÈFA^B<šüòy„”U.*q”g£ÉˆúDr£££Rƒ½%ªºÑäó¨ê
Ô[åÃn‡Ê&
PïeM#¨ô#П@
yîøS§£×oÐN”‘4I  É4ïP„•&”p½»ìòº'\áoPÞ=Öà    "c\§ÈΓ!}ïb£ó[Õ¨&‚Þ­    Aõ&üÔ,ÂaüÝúÞz”Ï}Øì%ºÕW(ûìU?¡aeŸ|×cöyß‹Š’”‰
|DQ!I±<=÷~r9ÔÊlÒƒN"N&´HR4-J$ÉÓ“Ág,Ã4ʆiõ•y†Ñ,Ai_Ô3[P¢çG Éó¿%vú±Èóm>õŽð1S0˜*ÎúQu.k½mœÍÌÎdö(ëMÆY³é^““±W÷R  ÈNsS Ë¦8Ž­—]‘å÷1[R'na60Úé†>øW²Ž5P-²û©8¢:®Z†Kk'ÎwDh¯£ÐòºÙC@æBƒ¾” ÎiWšb…xm+ÇìVsö|ö,Õ­võZÜR;\ŽYÅÁW4³¥\n*wÖŦ*u{+im¨®USÎÇ×ÇÊ÷뛚:GYZ\ð‹M{w-Œ‹–aòrIÎö
FÙtetÝ]´Óþø’^¬sŠo/;u,šóQÝýó(âA~Ñ7‹Ònzé.;ºÜI’¼‚Øç7öù‡>Ôö‘;Rr_ny;¥Øl=ŸÝ ~Õxööq
Pw0´§E·N÷صÎè%·È¡$8Ë¡ÊS|,û§NpÎ]ìÒ‚tÚ—ÙÅœ‡Á9¸«ÛÄ×ÝlãTÛUwne
o3–Ü«u!CeKzjÜr÷½,³ëã}®®3èÑX§Çêa(”$Ù9Ü8m3*Ÿ:g:{¬¸Òf®öâ
͇|mÎl¤¦|tØ?Xèr†¹?òšpa¯cÀTùF{Èb0}±³„oWüµ•I¾ÝMU>Ëó²-k‰…ÆÞDIÔõüî•«@Ù<ƒ‡K·Ýÿ«&I,‚~)
Ôip èN“u™ÖŽ¦åY3V·ækyàp[D%¨Þ¸j‚î-|ü0(ŠžôÍ}ÍÑëëœÓ¦ƒI€({~Ž`iŽ# h‚¡hB‰
Kþ.Ï    ¤$Qá"$XF"‰>Íø>’‚>ŠòúMÞôO¶×?KÒg·yÝgzýÚ«7}QÈÉD“ÍÉä)S¯ÿþ]ßÍw,‘
’äYHQo”‹/ ×€Ù="(Š~ ÐDCaúyHÍèS‚ÏJb¯&ÿ”®I^Ã^W£ä¿‘wŽœ0â?(ï5&ÀÕ´ý‡5þYâÿÆí‡JÿS
®ÀÎ üëóçTÁe•Ÿñ¯ï­üõf|   ùIåÿÍ´Ù^¡™þÚXÌÆã¶ß¥ÿN3þí“|°Ìa‚sE̦cy\Láê»ÕFÎüFî(ZfO…]ñ¦ã¨õ;ˆíÕx·‡ô,†c™µ(çzÓ-4;çÉVMœn:¯R}=o’0
X…—¦ÍTç\Ï>L“B°Éúê¯/7\ÐÓUÐXšcvl,fŒð‡¢1Ê}lcÑ[Zm±­¿YY#ïܽä`xýrMt™Æ÷ã¸ràöD‘×y#×É™/4êTÒ9·5­óÅìâ  GÓ=S‚  ‹lY3*^$Ö¢=ð)çjS%ÎjÙ‹Kqž6ç«› ÎnÏŽgQ­'Q{gJ­-;}Ìî´.N3]‘ť…   c…Ç5c/Òìæ­Õ9åBÙÊUUßVk XrÇ;í°£
rÇÂ’Ò–‚'ÆTH5_?K%>ÂóõºB13f-иU“ŹxZøÇóXÔ
›`k$”­$ØoÇÙB•œŽ›­[ÝúŠöi’ˆR—øʻڱó*,i-‘¹P}­Øýº'Íà°œûžÏõúò×Û‚ÙYSMWSWVy³åf“¯¶öã@Š¯¨ÑSûj¼C?A‘ñ×tøæ@&” € ×Æ'(
    „Oú4!Ë …@ÿt †>EÑ!"X!@’!0>Ë@DSÿÛø<ÿÿ_‡€ìÏ KJ„("ÑkƒHø(äˆ@$¸°·õY_©¤"a  

How can I download and decrypt the CloudTrail's log file?

UPDATE

I added these lines of code as follow:

AWSCredentialsProvider cp = new StaticCredentialsProvider(credentials); 
              InputStream is = s3object2.getObjectContent();
              byte[] bytes = IOUtils.toByteArray(is);
              ByteBuffer ciphertextBlob = ByteBuffer.wrap(bytes);

                     AWSKMS kms = AWSKMSClientBuilder.standard().withCredentials(cp).withRegion("eu-central-1").build();
                     DecryptRequest req = new DecryptRequest().withCiphertextBlob(ciphertextBlob);
                     ByteBuffer plainText = kms.decrypt(req).getPlaintext();

And this gives me error as follow:

Exception in thread "main" com.amazonaws.services.kms.model.InvalidCiphertextException: null (Service: AWSKMS; Status Code: 400; Error Code: InvalidCiphertextException; Request ID: 3260fbb1-51b0-11e7-a1e6-f561a86f2a15)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1588)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1258)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1030)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:742)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:716)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649)
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513)
    at com.amazonaws.services.kms.AWSKMSClient.doInvoke(AWSKMSClient.java:3036)
    at com.amazonaws.services.kms.AWSKMSClient.invoke(AWSKMSClient.java:3012)
    at com.amazonaws.services.kms.AWSKMSClient.executeDecrypt(AWSKMSClient.java:811)
    at com.amazonaws.services.kms.AWSKMSClient.decrypt(AWSKMSClient.java:787)
    at awslogdownloader.TestOne.main(TestOne.java:92)

I checked the metadata of the S3Object to see if it is encrypted, and it returns AES256 for getSSEAlgorithm but the getSSEAwsKmsKeyID returns null.

Answer 1

You need to use the KMS key to decrypt the data.

http://docs.aws.amazon.com/kms/latest/developerguide/programming-encryption.html

ByteBuffer ciphertextBlob = Place your ciphertext here;

DecryptRequest req = new DecryptRequest().withCiphertextBlob(ciphertextBlob);
ByteBuffer plainText = kms.decrypt(req).getPlaintext();