Hybrid Databricks Staging AWS S3 Bucket Requiring SSE-C.
Which destination?: Hybrid Databricks Staging AWS S3 bucket
Refer Ticket: #399858
Additional details:
SSE-C uploads are blocked as per the Novartis standard security policy. This restriction is enforced across our S3 buckets, so SSE-C based uploads would not be permitted.
Could you please confirm whether it is possible to use customer-managed KMS keys, that is SSE-KMS with CMK, for this integration instead?
This would be aligned with the pattern we are using for HVR, where the customer-managed KMS key is provided/configured for encryption.
From an architecture and security standpoint, the preferred approach would be:
- Avoid SSE-C, as it is not allowed by the standard bucket policy
- Use SSE-KMS with a customer-managed KMS key
- Grant the required IAM role access to the CMK
- Ensure the S3 bucket policy and KMS key policy allow the required read/write operations
- Validate that the application can specify or use the configured KMS key during upload
Please sign in to leave a comment.
Comments
0 comments