Configure S3 Bucket Encryption

The dataserver.aws.s3.bucket.encryption.check.enable configuration flag controls automatic fetching of bucket encryption settings from AWS S3.

When enabled, DataServer calls the AWS S3 to detect encryption settings and automatically adds KMS permissions to STS tokens if buckets use SSE-KMS encryption. The default value is false.

  1. SSH to the instance where Privacera Manager is installed.
  2. Run the following command to open the vars.dataserver.aws.yml file.
    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/vars.dataserver.aws.yml
  3. Uncomment the DATA_SERVER_AWS_S3_BUCKET_ENCRYPTION_CHECK_ENABLE property and set it to "true":
    YAML
    1
    DATA_SERVER_AWS_S3_BUCKET_ENCRYPTION_CHECK_ENABLE: "true"
  4. Once the properties are configured, refer to the Privacera Manager Quickstart.

For a DataServer Runtime connector, configure this property under Custom Properties:

  1. Open the connector and go to Access Control Configs → Connector Configs → Common Properties → Custom Properties.
  2. Select Add property and set:
    • Key: dataserver.aws.s3.bucket.encryption.check.enable
    • Value: true
  3. Select Save. The Runtime Manager redeploys the connector.