Skip to content
This repository was archived by the owner on Mar 31, 2026. It is now read-only.

Commit 5f27ffa

Browse files
HemangChothanifrankyn
HemangChothani
and
frankyn
authored
fix(storage): fix upload object with bucket cmek enabled (#158)
* fix(storage): fix upload object with bucket cmek enabled * fix(storage): add comments for condition used * fix(storage): nit Co-authored-by: Frank Natividad <frankyn@users.noreply.github.com>
1 parent 76dd9ac commit 5f27ffa

3 files changed

Lines changed: 65 additions & 4 deletions

File tree

‎google/cloud/storage/blob.py‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1280,7 +1280,15 @@ def _do_multipart_upload(
12801280
if self.user_project is not None:
12811281
name_value_pairs.append(("userProject", self.user_project))
12821282

1283-
if self.kms_key_name is not None:
1283+
# When a Customer Managed Encryption Key is used to encrypt Cloud Storage object
1284+
# at rest, object resource metadata will store the version of the Key Management
1285+
# Service cryptographic material. If a Blob instance with KMS Key metadata set is
1286+
# used to upload a new version of the object then the existing kmsKeyName version
1287+
# value can't be used in the upload request and the client instead ignores it.
1288+
if (
1289+
self.kms_key_name is not None
1290+
and "cryptoKeyVersions" not in self.kms_key_name
1291+
):
12841292
name_value_pairs.append(("kmsKeyName", self.kms_key_name))
12851293

12861294
if predefined_acl is not None:
@@ -1417,7 +1425,15 @@ def _initiate_resumable_upload(
14171425
if self.user_project is not None:
14181426
name_value_pairs.append(("userProject", self.user_project))
14191427

1420-
if self.kms_key_name is not None:
1428+
# When a Customer Managed Encryption Key is used to encrypt Cloud Storage object
1429+
# at rest, object resource metadata will store the version of the Key Management
1430+
# Service cryptographic material. If a Blob instance with KMS Key metadata set is
1431+
# used to upload a new version of the object then the existing kmsKeyName version
1432+
# value can't be used in the upload request and the client instead ignores it.
1433+
if (
1434+
self.kms_key_name is not None
1435+
and "cryptoKeyVersions" not in self.kms_key_name
1436+
):
14211437
name_value_pairs.append(("kmsKeyName", self.kms_key_name))
14221438

14231439
if predefined_acl is not None:

‎tests/system/test_system.py‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1966,6 +1966,30 @@ def test_rewrite_rotate_csek_to_cmek(self):
19661966

19671967
self.assertEqual(dest.download_as_string(), source_data)
19681968

1969+
def test_upload_new_blob_w_bucket_cmek_enabled(self):
1970+
blob_name = "test-blob"
1971+
payload = b"DEADBEEF"
1972+
alt_payload = b"NEWDEADBEEF"
1973+
1974+
kms_key_name = self._kms_key_name()
1975+
self.bucket.default_kms_key_name = kms_key_name
1976+
self.bucket.patch()
1977+
self.assertEqual(self.bucket.default_kms_key_name, kms_key_name)
1978+
1979+
blob = self.bucket.blob(blob_name)
1980+
blob.upload_from_string(payload)
1981+
# We don't know the current version of the key.
1982+
self.assertTrue(blob.kms_key_name.startswith(kms_key_name))
1983+
1984+
blob.upload_from_string(alt_payload, if_generation_match=blob.generation)
1985+
self.case_blobs_to_delete.append(blob)
1986+
1987+
self.assertEqual(blob.download_as_string(), alt_payload)
1988+
1989+
self.bucket.default_kms_key_name = None
1990+
self.bucket.patch()
1991+
self.assertIsNone(self.bucket.default_kms_key_name)
1992+
19691993

19701994
class TestRetentionPolicy(unittest.TestCase):
19711995
def setUp(self):

‎tests/unit/test_blob.py‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1525,7 +1525,7 @@ def _do_multipart_success(
15251525
if predefined_acl is not None:
15261526
qs_params.append(("predefinedAcl", predefined_acl))
15271527

1528-
if kms_key_name is not None:
1528+
if kms_key_name is not None and "cryptoKeyVersions" not in kms_key_name:
15291529
qs_params.append(("kmsKeyName", kms_key_name))
15301530

15311531
if if_generation_match is not None:
@@ -1579,6 +1579,17 @@ def test__do_multipart_upload_with_kms(self, mock_get_boundary):
15791579
)
15801580
self._do_multipart_success(mock_get_boundary, kms_key_name=kms_resource)
15811581

1582+
@mock.patch(u"google.resumable_media._upload.get_boundary", return_value=b"==0==")
1583+
def test__do_multipart_upload_with_kms_with_version(self, mock_get_boundary):
1584+
kms_resource = (
1585+
"projects/test-project-123/"
1586+
"locations/us/"
1587+
"keyRings/test-ring/"
1588+
"cryptoKeys/test-key"
1589+
"cryptoKeyVersions/1"
1590+
)
1591+
self._do_multipart_success(mock_get_boundary, kms_key_name=kms_resource)
1592+
15821593
@mock.patch(u"google.resumable_media._upload.get_boundary", return_value=b"==0==")
15831594
def test__do_multipart_upload_with_retry(self, mock_get_boundary):
15841595
self._do_multipart_success(mock_get_boundary, num_retries=8)
@@ -1685,7 +1696,7 @@ def _initiate_resumable_helper(
16851696
if predefined_acl is not None:
16861697
qs_params.append(("predefinedAcl", predefined_acl))
16871698

1688-
if kms_key_name is not None:
1699+
if kms_key_name is not None and "cryptoKeyVersions" not in kms_key_name:
16891700
qs_params.append(("kmsKeyName", kms_key_name))
16901701

16911702
if if_generation_match is not None:
@@ -1770,6 +1781,16 @@ def test__initiate_resumable_upload_with_kms(self):
17701781
)
17711782
self._initiate_resumable_helper(kms_key_name=kms_resource)
17721783

1784+
def test__initiate_resumable_upload_with_kms_with_version(self):
1785+
kms_resource = (
1786+
"projects/test-project-123/"
1787+
"locations/us/"
1788+
"keyRings/test-ring/"
1789+
"cryptoKeys/test-key"
1790+
"cryptoKeyVersions/1"
1791+
)
1792+
self._initiate_resumable_helper(kms_key_name=kms_resource)
1793+
17731794
def test__initiate_resumable_upload_without_chunk_size(self):
17741795
self._initiate_resumable_helper(blob_chunk_size=None)
17751796

0 commit comments

Comments
 (0)