Skip to main content
Docs
Feature Requests Onboarding Trust Center Status Page

Community

Hybrid Databricks Staging AWS S3 Bucket Requiring SSE-C.

Nitin Bhagat User

Which destination?: Hybrid Databricks Staging AWS S3 bucket

Refer Ticket: #399858

Additional details:

SSE-C uploads are blocked as per the Novartis standard security policy. This restriction is enforced across our S3 buckets, so SSE-C based uploads would not be permitted.
 
Could you please confirm whether it is possible to use customer-managed KMS keys, that is SSE-KMS with CMK, for this integration instead?
 
This would be aligned with the pattern we are using for HVR, where the customer-managed KMS key is provided/configured for encryption.
 
From an architecture and security standpoint, the preferred approach would be:
 
- Avoid SSE-C, as it is not allowed by the standard bucket policy
- Use SSE-KMS with a customer-managed KMS key
- Grant the required IAM role access to the CMK
- Ensure the S3 bucket policy and KMS key policy allow the required read/write operations
- Validate that the application can specify or use the configured KMS key during upload

Please sign in to leave a comment.

Comments

1 comment

Date Votes
  • Nitin Bhagat User
    There are two separate control areas involved in this issue:
     
    1. SSE-C enablement
    2. Default Novartis S3 deny policies enforcing KMS encryption
     
    SSE-C was already disabled, but the connector was still failing.
     
    As requested, we temporarily removed the default S3 deny policy to validate whether the connection could be established without the encryption-enforcement block. We also tested the scenario with SSE-C enablement and with the deny statements removed from the bucket policy. Under those conditions, the connection worked successfully.
     
    However, from a Novartis security and compliance standpoint:
     
    • SSE-C cannot be enabled
    • Default deny policies enforcing KMS encryption cannot be removed or weakened
     
    Therefore, removing the deny policy is not an acceptable mitigation. It was only used as a diagnostic step to confirm the root cause.
     
    A feature request has already been raised for SSE-C handling. However, the remaining requirement is that the connector must support operating successfully with the standard Novartis S3 bucket policy in place, including the explicit deny controls that enforce SSE-KMS encryption.
     
    To be clear, the expected target state is:
     
    • The connector writes to S3 using server-side encryption with AWS KMS
    • The connector sends the required SSE-KMS headers during `PutObject`
    • The default Novartis S3 bucket deny policies remain enabled
    • SSE-C remains disabled
    • No exception or weakening of the Novartis encryption enforcement policy is required
     
    Please confirm the product-side mitigation or connector configuration required to support this compliant operating model.
     
    Fivetran Ticket: #399858 
     
    This can be considered a reference AWS S3 policy pattern for the integration; however, it should not be treated as an exhaustive or final policy definition. The actual implementation may require environment-specific adjustments, including bucket name, prefix scope, IAM role, KMS key ARN, encryption conditions, VPC endpoint restrictions, and any applicable Novartis-standard security controls.
    "{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Deny",
                "Principal": {
                    "AWS": "*"
                },
                "Action": "s3:*",
                "Resource": [
                    "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid",
                    "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid/*"
                ],
                "Condition": {
                    "Bool": {
                        "aws:SecureTransport": "false"
                    }
                }
            },
            {
                "Sid": "FivetranBucketAccess",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::xxxxxxxxxxxx:role/xxxxxxxxxxxx2"
                },
                "Action": [
                    "s3:GetBucketLocation",
                    "s3:ListBucket",
                    "s3:ListBucketMultipartUploads"
                ],
                "Resource": "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid"
            },
            {
                "Sid": "FivetranObjectAccess",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::xxxxxxxxxxxx:role/xxxxxxxxxxxx2"
                },
                "Action": [
                    "s3:AbortMultipartUpload",
                    "s3:GetObject",
                    "s3:GetObjectVersion",
                    "s3:GetObjectAcl",
                    "s3:PutObject",
                    "s3:PutObjectAcl",
                    "s3:PutObjectTagging",
                    "s3:DeleteObject",
                    "s3:DeleteObjectVersion",
                    "s3:DeleteObjectTagging",
                    "s3:ReplicateObject"
                ],
                "Resource": "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid/*"
            },
            {
                "Sid": "FivetranBucketAccess2",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::xxxxxxxxxxxx:role/xxxxxxx_AWS_APP01_DEV_xxxxxxxxxxx"
                },
                "Action": [
                    "s3:GetBucketLocation",
    "s3:ListBucket",
                    "s3:ListBucketMultipartUploads"
                ],
                "Resource": "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid"
            },
            {
                "Sid": "FivetranObjectAccess2",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::xxxxxxxxxxxx:role/xxxxxxx_AWS_APP01_DEV_xxxxxxxxxxx"
                },
                "Action": [
                    "s3:AbortMultipartUpload",
                    "s3:GetObject",
                    "s3:GetObjectVersion",
                    "s3:GetObjectAcl",
                    "s3:PutObject",
                    "s3:PutObjectAcl",
                    "s3:PutObjectTagging",
                    "s3:DeleteObject",
                    "s3:DeleteObjectVersion",
                    "s3:DeleteObjectTagging",
                    "s3:ReplicateObject"
                ],
                "Resource": "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid/*"
            },
            {
                "Sid": "EnforceEncryption",
                "Effect": "Deny",
                "Principal": {
                    "AWS": "*"
                },
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid/*",
                "Condition": {
                    "Null": {
                        "s3:x-amz-server-side-encryption": "true"
                    }
                }
            },
            {
                "Sid": "DenyUnEncryptedObjectUploads",
                "Effect": "Deny",
                "Principal": {
                    "AWS": "*"
                },
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid/*",
                "Condition": {
                    "StringNotEquals": {
                        "s3:x-amz-server-side-encryption": "aws:kms"
                    }
                }
            },
            {
                "Sid": "RestrictAccessBasedOnVpcId",
                "Effect": "Deny",
                "Principal": {
                    "AWS": "arn:aws:iam::xxxxxxxxxxxxxx:role/xxxxxxxxxx_AWS_APP01_xxxxxx_DEV_SANDBOX_FT"
                },
                "Action": "s3:*",
                "Resource": [
                    "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid",
                    "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid/*"
                ],
                "Condition": {
                    "ForAllValues:StringNotLike": {
                        "aws:VpceOrgPaths": "o-gxxxxxxx/r-gu8r/ou-gu8r-gxxxxxx/ou-gu8rxxxxxx/*"
                    },
                    "StringNotEquals": {
                        "aws:sourceVpc": [
                            "vpc-123456",
                            "vpc-123456",
                            "vpc-123456",
                            "vpc-123456",
                            "vpc-123456",
                            "vpc-123456",
                            "vpc-123456"
                        ]
                    }
                }
            },
            {
                "Sid": "WizDenyUnEncryptedObjectUploads",
                "Effect": "Deny",
                "Principal": "*",
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::xxxxxxxxxxxxx01-xxxxxx-eu-xxxx-1-dev-sandbox-ft-hybrid/*",
                "Condition": {
                    "StringNotEquals": {
                        "s3:x-amz-server-side-encryption": "aws:kms"
                    }
                }
            }
        ]
    }"