Liferay DXP and S3 security

Issue

• Does Liferay support server-side encryption on Amazon S3?
• Is Liferay calling S3 over HTTPS only?
• Will Liferay work on a restricted S3 bucket without public access?

Environment

• Liferay 7.0 DXP
• Liferay 7.1 DXP
• Liferay 7.2 DXP

Resolution

• On the AWS Management Console, all three options listed under "Default Encryption" (None - AES-256 - AWS-KMS) will work and will be supported on Liferay. Opposite to 6.2 EE and LPS-46680, in 7.0+ DXP, as a result of LPS-58119, Liferay uses the official Amazon AWS SDK rather than jets3t:
  
  

• Liferay uses the default protocol for the Amazon SDK, which is HTTPS.
  https://github.com/aws/aws-sdk-java/blob/1.11.277/aws-java-sdk-core/src/main/java/com/amazonaws/ClientConfiguration.java#L145-L150
   
 
• Liferay does not require that public access be given to any S3 objects. As far as Liferay is concerned, the only thing that matters is that the Amazon SDK is able to add files to the bucket, delete files it's added from the bucket, and retrieve any files it's added from the bucket. If the access is restricted through IAM roles, or it's done through an access key and secret key pair, Liferay will still work fine

Additional Information

• About "default encryption" option:
  https://docs.aws.amazon.com/ AmazonS3/latest/dev/bucket- encryption.html
  https://aws.amazon.com/blogs/ aws/new-amazon-s3-encryption- security-features
• About general info on Liferay S3 connection see also: Using Amazon Simple Storage Service