Skip to content

fix: throw S3EC error on GCM key/IV reuse #513

Merged
rishav-karanjit merged 11 commits into
mainfrom
crossRegionRoundTrip
May 20, 2026
Merged

fix: throw S3EC error on GCM key/IV reuse #513
rishav-karanjit merged 11 commits into
mainfrom
crossRegionRoundTrip

Conversation

@rishav-karanjit
Copy link
Copy Markdown
Member

@rishav-karanjit rishav-karanjit commented May 19, 2026

Issue #, if available:
#510

Description of changes:

This is a little bending change as expected error type is getting change but I don't think consumers of S3EC will be depending on the JCE error.

When crossRegionAccessEnabled(true) triggers a redirect, the SDK re-subscribes to the request body, which would reuse the same AES-GCM key/IV. This change wraps the encrypted request body in NoRetriesAsyncRequestBody to proactively block re-subscription with a clear S3EncryptionClientException instead of low-level error message thrown by JCE provider.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Check any applicable:

  • Were any files moved? Moving files changes their URL, which breaks all hyperlinks to the files.

@rishav-karanjit rishav-karanjit changed the title chore: add cross region round trip test fix: block request body re-subscription to prevent attempt to GCM key/IV reuse May 20, 2026
@rishav-karanjit rishav-karanjit changed the title fix: block request body re-subscription to prevent attempt to GCM key/IV reuse fix: throw S3EC error on GCM key/IV reuse May 20, 2026
@rishav-karanjit rishav-karanjit marked this pull request as ready for review May 20, 2026 22:32
@rishav-karanjit rishav-karanjit requested a review from a team as a code owner May 20, 2026 22:32
@rishav-karanjit rishav-karanjit merged commit 53dc99d into main May 20, 2026
25 checks passed
@rishav-karanjit rishav-karanjit deleted the crossRegionRoundTrip branch May 20, 2026 23:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants