---
# System prepended metadata

title: OADP SSE-C customer key
tags: [encryption, ransomware]

---

# OADP SSE-C 
* server side encryption, customer provided key

## AWS Default Encryption on S3
* https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html


## links
* https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html#sse-c-highlights
* https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html
* cookbook
    * SSE-C https://catalog.us-east-1.prod.workshops.aws/workshops/aad9ff1e-b607-45bc-893f-121ea5224f24/en-US/s3/serverside/ssec
    * Client-side encryption https://catalog.us-east-1.prod.workshops.aws/workshops/aad9ff1e-b607-45bc-893f-121ea5224f24/en-US/s3/clientside


* https://github.com/vmware-tanzu/velero-plugin-for-aws/blob/main/backupstoragelocation.md
```
    # Specify the file that contains the SSE-C customer key to enable customer key encryption of the backups
    # stored in S3. The referenced file should contain a 32-byte string.
    #  
    # The customerKeyEncryptionFile points to a mounted secret within the velero container.
    # Add the below values to the velero cloud-credentials secret:
    # customer-key: <your_b64_encoded_32byte_string>
    # The default value below points to the already mounted secret.
    # 
    # Cannot be used in conjunction with kmsKeyId.
    #
    # Optional (defaults to "", which means SSE-C is disabled).
    customerKeyEncryptionFile: "/credentials/customer-key"
```
  * WHY use customer-key?  By default aws s3 is encrypted ( look at the properties ).  We need a level of encryption that is not unlocked w/ the users aws key/secret-key.

  * Create the Key:
  ```
dd if=/dev/urandom bs=1 count=32 > sse.key
cat sse.key | base64 > sse_encoded.key
ln -s sse_encoded.key customer-key
  ```
  
  * Create the cloud-credentials secret. 
```
oc create secret generic cloud-credentials --namespace openshift-adp --from-file cloud=<path>/openshift_aws_credentials,customer-key=<path>/sse_encoded.key
```
  
  * Alternatively, update existing cloud-credentials secret data.
  `customer-key: <value of customer-key>`
  ```
  whayutin@thinkdoe:~$ oc get secrets -n openshift-adp cloud-credentials -o yaml
apiVersion: v1
data:
  cloud: W2Rfa2V5X2lkPSJBS0lBVkJRWUIyRkQ0TlFHRFFPQiIKYXdzX3NlY3JldF9hY2Nlc3Nfa2V5P<snip>rUE1mNWVSbTN5K2FpeWhUTUQyQk1WZHBOIgo=
  customer-key: v+<snip>TFIiq6aaXPbj8dhos=
kind: Secret
metadata:
  creationTimestamp: "2024-04-16T14:19:44Z"
  labels:
    openshift-adp.dataprotectionapplication: dpa-sample
    openshift.io/oadp: "True"
  name: cloud-credentials
  namespace: openshift-adp
  resourceVersion: "26734766"
  uid: 042cc208-b71f-4483-9107-0d8dded00d36
type: Opaque
whayutin@thinkdoe:~$ 
  ```
  
  ```
  cat customer-key 
v+YZbdgZBw99e01KvYYDKIgItDTFIiq6aaXPbj8dhos=
  ```
  * DPA example
  ```
  spec:
  backupLocations:
    - velero:
        config:
          customerKeyEncryptionFile: /credentials/customer-key
          profile: default
   ```
   
   WOOT 
   * Backup and Restore works
  
  ## testing
  
  * Create a test file
  ```
  echo "encrypt me please" > test.txt
  ```
  
  * upload the test file
  ```
  aws s3api put-object \
    --bucket cvpbucketuswest2 \
    --key test.txt \
    --body test.txt \
    --sse-customer-key fileb://sse.key \
    --sse-customer-algorithm AES256
  ```
  
  * Try to download the file
    * via the s3 web console
    * `s3cmd get s3://cvpbucketuswest2/test.txt test.txt`
This should fail as the file is now encrypted w/ an extra key

  * Download the file with key
```
aws s3api get-object \
    --bucket cvpbucketuswest2 \
    --key test.txt \
    --sse-customer-key fileb://sse.key \
    --sse-customer-algorithm AES256 \
    downloaded.txt
```

```
cat downloaded.txt 
encrypt me please
```

  * The same download call can be executed on velero backed up files
  ```
  aws s3api get-object \
    --bucket cvpbucketuswest2 \
    --key velero/backups/mysql-persistent-customerkeyencryptionfile4/mysql-persistent-customerkeyencryptionfile4.tar.gz \
    --sse-customer-key fileb://sse.key \
    --sse-customer-algorithm AES256 \
    --debug \
    velero_download.tar.gz
  ````
  
   ````
   tar -zxvf velero_download.tar.gz
   ````
   
```
ls
metadata  resources  velero_download.tar.gz
whayutin@thinkdoe:/tmp/wes$ less resources/
clusterserviceversions.operators.coreos.com/      persistentvolumes/
configmaps/                                       pods/
customresourcedefinitions.apiextensions.k8s.io/   replicasets.apps/
datauploads.velero.io/                            replicationcontrollers/
deploymentconfigs.apps.openshift.io/              rolebindings.authorization.openshift.io/
deployments.apps/                                 rolebindings.rbac.authorization.k8s.io/
endpoints/                                        routes.route.openshift.io/
endpointslices.discovery.k8s.io/                  secrets/
events/                                           securitycontextconstraints.security.openshift.io/
namespaces/                                       serviceaccounts/
persistentvolumeclaims/                           services/
```
   
## GOTCHA's

* If the sse.key is changed the velero server will need to be restarted to mount the updated key.


## Additional references
https://www.bleepingcomputer.com/news/security/ransomware-abuses-amazon-aws-feature-to-encrypt-s3-buckets/

https://arcticwolf.com/resources/blog/ransomware-campaign-encrypting-amazon-s3-buckets-using-sse-c/

https://aws.amazon.com/blogs/storage/protecting-data-with-amazon-s3-object-lock/

## aws s3 object locking
* https://aws.amazon.com/blogs/storage/protecting-data-with-amazon-s3-object-lock/
* https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html?icmpid=docs_amazons3_console
* https://github.com/vmware-tanzu/velero/issues/7400
* https://github.com/vmware-tanzu/velero-plugin-for-aws/pull/194
* 




