Uploading Client-Side Encrypted Data for Use
in Amazon Redshift
With Amazon Redshift, you can copy data from an Amazon S3 bucket to an Amazon Redshift database.
The data that you copy can be encrypted on either the serverside or clientside. In server-side encryption,
Amazon S3 handles encryption and decryption, transparently. In client-side encryption, you manage the
encryption keys and the related encryption and decryption process.
This topic explains how to upload client-side encrypted data in Amazon S3 so that you can work with it
in Amazon Redshift.
To work with Amazon S3 client-side encrypted data in Amazon Redshift, follow the steps outlined in
Specifying Client-Side Encryption Using the AWS SDK for Java
in the Amazon S3 Developer Guide with
the additional requirements that you use:
• Symmetric encryption — The AWS SDK for Java
AmazonS3EncryptionClient
class uses a
process called envelope encryption which is based on symmetric key encryption. Use this class to
create an Amazon S3 client to upload client-side encrypted data.
• 256-bit AES master symmetric key — A master key encrypts the envelope key. You pass the master
key to your instance of the
AmazonS3EncryptionClient
class. The master key must use the 256-AES
encryption standard. Save this key because you will need it to copy data into Amazon Redshift.
• Object metadata to store encrypted envelope key— By default, AmazonS3 stores the envelope key
as object metadata for the
AmazonS3EncryptionClient
class. The encrypted envelope key that is
stored as object metadata is used during the decryption process.
After your data is stored in Amazon S3 by using client-side encryption, a database COPY operation will
decrypt the data as it is copied to Amazon Redshift. The COPY command uses the master symmetric
key you specified. For more information, go to
Loading encrypted data files from Amazon S3
in the Amazon
Redshift Developer Guide.
Note
If you get a cipher encryption error message when you use the encryption API for the first time,
your version of the JDK may have a Java Cryptography Extension (JCE) jurisdiction policy file
that limits the maximum key length for encryption and decryption transformations to 128 bits.
For information about addressing this issue, go to
Specifying Client-Side Encryption Using the
AWS SDK for Java
in the Amazon Simple Storage Service Developer Guide.
Example: Uploading Client-Side Encrypted Data
The following example uploads a directory of objects to an Amazon S3 bucket by using client-side
encryption.The example shows the choices you must make during client-side encryption so that the data
can be loaded in Amazon Redshift. Specifically, the example shows the use of a 256-bit AES master
symmetric key and using object metadata to store the encrypted envelope key. For more information,
see
Uploading Client-Side Encrypted Data for Use in Amazon Redshift (p. 120)
.
The example uses a
.properties
file to configure the upload program. The properties file specifies the
master symmetric key, a bucket location, a prefix for all uploaded objects, and a source location to read
the objects. These are all values you must supply.
The following code shows the properties file called
SampleEncryptAndUploadDataToS3.properties
.
# Base64 encoded AES 256 bit symmetric master key.
master_symmetric_key=<enter your key here>
API Version 2012-12-01
120
Amazon Redshift Management Guide
Uploading Client-Side Encrypted Data
