下載並解密存儲桶中的加密AWS CloudTrail日誌

Question

我試圖下載存儲在S3存儲桶中的CloudTrail日誌文件，但是當我收到該文件時，無法讀取該文件，直到我意識到它可以按照說here加密並且我不知道如何解密文件。

這裏是我的代碼：

AWSCredentials credentials = new BasicAWSCredentials(prop.getProperty("provider.aws01.username"), prop.getProperty("provider.aws01.password")); 
      s3client = new AmazonS3Client(credentials); 
     S3Object s3object = s3client.getObject(new GetObjectRequest(
       bucketName, "examplecloudtraillog.json.gz")); 
      System.out.println("Encrypted with: " + 
       s3object.getObjectMetadata().getSSEAlgorithm()); 
      InputStream is = s3object.getObjectContent(); 
      OutputStream outputStream = 
        new FileOutputStream(new File("test.txt")); 

     int read = 0; 
     byte[] bytes = new byte[1024]; 

     while ((read = is.read(bytes)) != -1) { 
      outputStream.write(bytes, 0, read); 
     } 

     System.out.println("Done!"); 

當我收到它看起來像亂碼的文件，這裏是輸出文件：

‹  ÅUÛ²¢Xý• 
_OQr¿øxDÅž‰Ž 
{£ÈU6 Xqþ½Ásº«ººª§f¢#&‚13W^ȵòóÈFA^B<šüòy„」U.*q」g£ÉˆúDr£££Rƒ½%ªºÑäó¨ê 
Ô[åÃn‡Ê& 
PïeM#¨ô#П@ 
yîøS§£×oÐN」‘4I É4ïP„•&」p½»ìòº'\áoPÞ=Öà "c\§ÈÎ「!}ïb£ó[Õ¨&‚Þ­ Aõ&üÔ,ÂaüÝúÞz」Ï}Øì%ºÕW(ûìU?¡aeŸ|×cöyß‹Š’」‰ 
|DQ!I±<=÷~r9ÔÊlÒƒN"N&´HR4-J$ÉÓ「Ág,Ã4ʆiõ•y†Ñ,Ai_Ô3[P¢çG Éó¿%vú±Èóm>õŽð1S0˜*ÎúQu.k½mœÍÌÎdö(ëMÆY³é^「「±W÷R  ÈNsS Ë¦8Ž­—]‘å÷1[R'na60Úé†>øW²Ž5P-²û©8¢:®Z†Kk'ÎwDh¯£ÐòºÙC@æBƒ¾」 ÎiWšb…xm+ÇìVsö|ö,Õ­võZÜR;\ŽYÅÁW4³¥\n*wÖŦ*u{+im¨®USÎÇ×ÇÊ÷뛚:GYZ\ð‹M{w-Œ‹–aòrIÎö 
FÙtetÝ]´Óþø’^¬sŠo/;u,šóQÝýó(âA~Ñ7‹Ònzé.;ºÜI’¼‚Øç7öù‡>Ôö‘;Rr_ny;¥Øl=ŸÝ ~Õxööq 
Pw0´§E·N÷صÎè%·È¡$8Ë¡ÊS|,û§NpÎ]ìÒ‚tÚ—ÙÅœ‡Á9¸«ÛÄ×ÝlãTÛUwne 
o3–Ü«u!CeKzjÜr÷½,³ëã}®®3èÑX§Çêa(」$Ù9Ü8m3*Ÿ:g:{¬¸Òf®öâ 
͇|mÎl¤¦|tØ?Xèr†¹?òšpa¯cÀTùF{Èb0}±³„oWüµ•I¾ÝMU>Ëó²-k‰…ÆÞDIÔõüî•«@Ù<ƒ‡K·Ýÿ«&I,‚~) 
Ôip èN「u™ÖŽ¦åY3V·ækyàp[D%¨Þ¸j‚î-|ü0(ŠžôÍ}ÍÑëëœÓ¦ƒI€({~Ž`iŽ# h‚¡hB‰ 
Kþ.Ï ¤$Qá"$XF"‰>Íø>’‚>ŠòúMÞôO¶×?KÒg·yÝgzýÚ«7}QÈÉD「ÍÉä)S¯ÿþ]ßÍw,‘ 
’äYHQo」‹/ ×€Ù="(Š~ ÐDCaúyHÍèS‚ÏJb¯&ÿ」®I^Ã^W£ä¿‘wŽœ0â?(ï5&ÀÕ´ý‡5þYâÿÆí‡JÿS 
®ÀÎ üëóçTÁe•Ÿñ¯ï­üõf| ùIåÿÍ´Ù^¡™þÚXÌÆã¶ß¥ÿN3þí「|°Ìa‚sE̦cy\Láê»ÕFÎüFî(ZfO…]ñ¦ã¨õ;ˆíÕx·‡ô,†c™µ(çzÓ-4;çÉVMœn:¯R}=o’0 
X…—¦ÍTç\Ï>L「B°Éúê¯/7\ÐÓUÐXšcvl,fŒð‡¢1Ê}lcÑ[Zm±­¿YY#ïܽä`xýrMt™Æ÷ã¸ràöD‘×y#×É™/4êTÒ9·5­óÅìâ GÓ=S‚ ‹lY3*^$Ö¢=ð)çjS%ÎjÙ‹Kqž6ç«› ÎnÏŽgQ­'Q{gJ­-;}Ìî´.N3]‘ť… c…Ç5c/Òìæ­Õ9åBÙÊUUßVk XrÇ;í°£ 
rÇÂ’Ò–‚'ÆTH5_?K%>ÂóõºB13f-иU「ŹxZøÇóXÔ 
›`k$」­$ØoÇÙB•œŽ›­[ÝúŠöi’ˆR—øʻڱó*,i-‘¹P}­Øýº'Íà°œûžÏõúò×Û‚ÙYSMWSWVy³åf「¯¶öã@Š¯¨ÑSûj¼C?A‘ñ×tøæ@&」 € ×Æ'(
    „Oú4!Ë …@ÿt †>EÑ!"X!@’!0>Ë@DSÿÛø<ÿÿ_‡€ìÏ KJ„("ÑkƒHø(äˆ@$¸°·õY_©¤"a 

如何下載和解密CloudTrail的日誌文件？

UPDATE

我添加幾行代碼如下：

AWSCredentialsProvider cp = new StaticCredentialsProvider(credentials); 
       InputStream is = s3object2.getObjectContent(); 
       byte[] bytes = IOUtils.toByteArray(is); 
       ByteBuffer ciphertextBlob = ByteBuffer.wrap(bytes); 

        AWSKMS kms = AWSKMSClientBuilder.standard().withCredentials(cp).withRegion("eu-central-1").build(); 
        DecryptRequest req = new DecryptRequest().withCiphertextBlob(ciphertextBlob); 
        ByteBuffer plainText = kms.decrypt(req).getPlaintext(); 

這給了我錯誤如下：

Exception in thread "main" com.amazonaws.services.kms.model.InvalidCiphertextException: null (Service: AWSKMS; Status Code: 400; Error Code: InvalidCiphertextException; Request ID: 3260fbb1-51b0-11e7-a1e6-f561a86f2a15) 
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1588) 
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1258) 
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1030) 
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:742) 
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:716) 
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699) 
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667) 
    at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649) 
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513) 
    at com.amazonaws.services.kms.AWSKMSClient.doInvoke(AWSKMSClient.java:3036) 
    at com.amazonaws.services.kms.AWSKMSClient.invoke(AWSKMSClient.java:3012) 
    at com.amazonaws.services.kms.AWSKMSClient.executeDecrypt(AWSKMSClient.java:811) 
    at com.amazonaws.services.kms.AWSKMSClient.decrypt(AWSKMSClient.java:787) 
    at awslogdownloader.TestOne.main(TestOne.java:92) 

我查了S3Object的元數據看看它是否被加密，並且返回getSSEAlgorithm的AES256，但getSSEAwsKmsKeyID返回null。

Answer 1

您需要使用KMS密鑰來解密數據。

http://docs.aws.amazon.com/kms/latest/developerguide/programming-encryption.html

ByteBuffer ciphertextBlob = Place your ciphertext here; 

DecryptRequest req = new DecryptRequest().withCiphertextBlob(ciphertextBlob); 
ByteBuffer plainText = kms.decrypt(req).getPlaintext();