# Bug when attempting to use logstash-output-s3 with encryption

**URL:** <https://discuss.elastic.co/t/bug-when-attempting-to-use-logstash-output-s3-with-encryption/89775>\
**Category:** Logstash\
**Created:** [June 16, 2017, 9:24pm UTC](https://discuss.elastic.co/t/bug-when-attempting-to-use-logstash-output-s3-with-encryption/89775 "2017-06-16T21:24:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josh\_Harrison](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@Josh\_Harrison](https://discuss.elastic.co/u/Josh_Harrison)\
**Post date:** [June 16, 2017, 9:24pm UTC](https://discuss.elastic.co/t/bug-when-attempting-to-use-logstash-output-s3-with-encryption/89775/1 "2017-06-16T21:24:45Z")

</div>

I have an s3 bucket where I have policy set like

> ```
> {
> "Version": "2012-10-17",
> "Id": "PutObjPolicy",
> "Statement": [
> {
> "Sid": "DenyIncorrectEncryptionHeader",
> "Effect": "Deny",
> "Principal": "*",
> "Action": "s3:PutObject",
> "Resource": "mybucketarn/*",
> "Condition": {
> "StringNotEquals": {
> "s3:x-amz-server-side-encryption": "AES256"
> }
> }
> },
> {
> "Sid": "DenyUnEncryptedObjectUploads",
> "Effect": "Deny",
> "Principal": "*",
> "Action": "s3:PutObject",
> "Resource": "mybucketarn/*",
> "Condition": {
> "Null": {
> "s3:x-amz-server-side-encryption": "true"
> }
> }
> }
> ]
> }
> 
> ```

This requires that all files uploaded to the bucket are encrypted with AES256.  
When I have my output block configured like this:

> ```
> output {
> s3{
> server_side_encryption => true
> server_side_encryption_algorithm => "AES256"
> access_key_id => "mykey"
> secret_access_key => "mykey"
> region => "my-region"
> bucket => "mybucket"
> codec => "json"
> }
> }
> 
> ```

I am unable to get logstash to successfully launch, producing an error like:  
` [2017-06-16T13:53:38,921][ERROR][logstash.outputs.s3] Error validating bucket write permissions! {:message=>"Access Denied", :class=>"Aws::S3::Errors::AccessDenied"}`

If I remove the policy, I am able to get encrypted files writing out to S3 just fine.

I believe this is because logstash-output-s3/lib/logstash/outputs/s3/write\_bucket\_permission\_validator.rb attempts to create a file to check that it has write permissions. Due to the bucket policy, since the file that write\_bucket\_permission\_validator.rb attempts to write is not encrypted, it is rejected and logstash decides that it can't output to s3.

It would be valuable if write\_bucket\_permission\_validator and/or writable\_directory\_validator.rb were configured to take encryption settings in the output parameterization into account when validating write access.

I've created a github issue with the same problem here: [If encryption is required on s3 bucket through bucket policy, output cannot start · Issue #146 · logstash-plugins/logstash-output-s3 · GitHub](https://github.com/logstash-plugins/logstash-output-s3/issues/146)

---

<div class="post-metadata">

**Author:** ![Josh\_Harrison](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@Josh\_Harrison](https://discuss.elastic.co/u/Josh_Harrison)\
**Post date:** [June 16, 2017, 10:04pm UTC](https://discuss.elastic.co/t/bug-when-attempting-to-use-logstash-output-s3-with-encryption/89775/2 "2017-06-16T22:04:54Z")

</div>

We can skip this check using validate\_credentials\_on\_root\_bucket =\> false - not sure if this is an appropriate workaround, though? Having the validation might still be useful in the case of the encrypted buckets.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2017, 10:05pm UTC](https://discuss.elastic.co/t/bug-when-attempting-to-use-logstash-output-s3-with-encryption/89775/3 "2017-07-14T22:05:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.