Merge pull request #7882 from therynamo/aws-encryption-s3

feat: Allow SSE on AWS S3 Buckets

.changeset/techdocs-orange-cougars-relax.md

@@ -0,0 +1,6 @@
+---
+'@backstage/techdocs-common': patch
+'@backstage/techdocs-backend': patch
+---
+
+Allow amazon web services s3 buckets to pass an server side encryption configuration so they can publish to encrypted buckets

docs/features/techdocs/configuration.md

@@ -106,6 +106,12 @@ techdocs:
       # This allows providers like LocalStack, Minio and Wasabi (and possibly others) to be used to host tech docs.
       s3ForcePathStyle: false
 
+      # (Optional) AWS Server Side Encryption
+      # Defaults to undefined.
+      # If not set, encrypted buckets will fail to publish.
+      # https://docs.aws.amazon.com/AmazonS3/latest/userguide/specifying-s3-encryption.html
+      sse: 'aws:kms' # or AES256
+
     # Required when techdocs.publisher.type is set to 'azureBlobStorage'. Skip otherwise.
 
     azureBlobStorage:

packages/techdocs-common/src/stages/publish/awsS3.test.ts

@@ -45,10 +45,12 @@ const createPublisherFromConfig = ({
   bucketName = 'bucketName',
   bucketRootPath = '/',
   legacyUseCaseSensitiveTripletPaths = false,
+  sse,
 }: {
   bucketName?: string;
   bucketRootPath?: string;
   legacyUseCaseSensitiveTripletPaths?: boolean;
+  sse?: string;
 } = {}) => {
   const mockConfig = new ConfigReader({
     techdocs: {
@@ -62,6 +64,7 @@ const createPublisherFromConfig = ({
           },
           bucketName,
           bucketRootPath,
+          sse,
         },
       },
       legacyUseCaseSensitiveTripletPaths,
@@ -171,6 +174,13 @@ describe('AwsS3Publish', () => {
       expect(await publisher.publish({ entity, directory })).toBeUndefined();
     });
 
+    it('should publish a directory when sse is specified', async () => {
+      const publisher = createPublisherFromConfig({
+        sse: 'aws:kms',
+      });
+      expect(await publisher.publish({ entity, directory })).toBeUndefined();
+    });
+
     it('should fail to publish a directory', async () => {
       const wrongPathToGeneratedDirectory = path.join(
         rootDir,

packages/techdocs-common/src/stages/publish/awsS3.ts

@@ -62,6 +62,7 @@ export class AwsS3Publish implements PublisherBase {
   private readonly legacyPathCasing: boolean;
   private readonly logger: Logger;
   private readonly bucketRootPath: string;
+  private readonly sse?: 'aws:kms' | 'AES256';
 
   constructor(options: {
     storageClient: aws.S3;
@@ -69,12 +70,14 @@ export class AwsS3Publish implements PublisherBase {
     legacyPathCasing: boolean;
     logger: Logger;
     bucketRootPath: string;
+    sse?: 'aws:kms' | 'AES256';
   }) {
     this.storageClient = options.storageClient;
     this.bucketName = options.bucketName;
     this.legacyPathCasing = options.legacyPathCasing;
     this.logger = options.logger;
     this.bucketRootPath = options.bucketRootPath;
+    this.sse = options.sse;
   }
 
   static fromConfig(config: Config, logger: Logger): PublisherBase {
@@ -92,6 +95,11 @@ export class AwsS3Publish implements PublisherBase {
       config.getOptionalString('techdocs.publisher.awsS3.bucketRootPath') || '',
     );
 
+    const sse = config.getOptionalString('techdocs.publisher.awsS3.sse') as
+      | 'aws:kms'
+      | 'AES256'
+      | undefined;
+
     // Credentials is an optional config. If missing, the default ways of authenticating AWS SDK V2 will be used.
     // 1. AWS environment variables
     // https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/loading-node-credentials-environment.html
@@ -138,6 +146,7 @@ export class AwsS3Publish implements PublisherBase {
       bucketRootPath,
       legacyPathCasing,
       logger,
+      sse,
     });
   }
 
@@ -208,6 +217,7 @@ export class AwsS3Publish implements PublisherBase {
   async publish({ entity, directory }: PublishRequest): Promise<void> {
     const useLegacyPathCasing = this.legacyPathCasing;
     const bucketRootPath = this.bucketRootPath;
+    const sse = this.sse;
 
     // First, try to retrieve a list of all individual files currently existing
     let existingFiles: string[] = [];
@@ -250,7 +260,8 @@ export class AwsS3Publish implements PublisherBase {
               bucketRootPath,
             ),
             Body: fileStream,
-          };
+            ...(sse && { ServerSideEncryption: sse }),
+          } as aws.S3.PutObjectRequest;
 
           return this.storageClient.upload(params).promise();
         },

plugins/techdocs-backend/config.d.ts

@@ -121,6 +121,14 @@ export interface Config {
              * @visibility backend
              */
             s3ForcePathStyle?: boolean;
+
+            /**
+             * (Optional) AWS Server Side Encryption
+             * Defaults to undefined.
+             * If not set, encrypted buckets will fail to publish.
+             * https://docs.aws.amazon.com/AmazonS3/latest/userguide/specifying-s3-encryption.html
+             */
+            sse?: 'aws:kms' | 'AES256';
           };
         }
       | {