Merge pull request #328 from balena-os/kyle/s3-sse

Enable S3 Server Side Encryption flags
balena-os · Feb 11, 2024 · cae4785 · cae4785
2 parents 6ccd3b1 + 93a2a37
commit cae4785
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/automation/entry_scripts/balena-generate-ami.sh b/automation/entry_scripts/balena-generate-ami.sh
@@ -114,7 +114,7 @@ create_aws_ebs_snapshot() {
     # Push to s3 and create the AMI
     echo "* Pushing ${img} to s3://${S3_BUCKET}"
     s3_url="s3://${S3_BUCKET}/preloaded-images/${s3_key}"
-    aws s3 cp "${img}" "${s3_url}"
+    aws s3 cp --sse AES256 "${img}" "${s3_url}"
 
     import_task_id=$(aws ec2 import-snapshot \
       --description "snapshot-${AMI_NAME}" \

diff --git a/automation/include/balena-deploy.inc b/automation/include/balena-deploy.inc
@@ -208,7 +208,7 @@ balena_deploy_to_s3() {
 		return 1
 	fi
 
-	local _s3_cmd="s4cmd --access-key=${_s3_access_key} --secret-key=${_s3_secret_key}"
+	local _s3_cmd="s4cmd --access-key=${_s3_access_key} --secret-key=${_s3_secret_key} --API-ServerSideEncryption=AES256"
 	local _s3_sync_opts="--recursive --API-ACL=${_s3_policy}"
 	if ! balena_lib_docker_pull_helper_image "balena/balena-img" "6.20.26" "" helper_image_id; then
 		return 1