Amazon web services 在不安装AWS SDK的情况下，如何通过带AES256加密的Powershell将文件上载到S3？

我想使用AES256加密将文件上载到AWS S3，但不允许安装AWS CLI。我有下面的代码，允许我上传文件到S3使用我的秘密密钥，但这不起作用，然后需要加密S3桶。如何使用下面的代码执行类似于：

aws s3api put对象——服务器端加密=AES256——bucket=--key=--body=/

    # Config Parts
$_rawfilename = 'C:/<NAME>/SSP00001_RITM1304145.csv'
$folder = 'TestResults'
$filename = $_rawfilename.Split('/')[2]
$keyFile = ($folder+ '/' + $filename)
$service = 's3'
$bucket = '<BUCKET NAME>'
$region = 'us-east-1'
$host1 = $bucket + '.s3'  + '.amazonaws.com'
$access_key = ''
$secret_key = ''
$br = [regex]::Unescape('\u000a')
function HmacSHA256($message, $secret) {
    $hmacsha = New-Object System.Security.Cryptography.HMACSHA256
    $hmacsha.key = $secret
    $signature = $hmacsha.ComputeHash([Text.Encoding]::ASCII.GetBytes($message))
    return $signature
}

function getSignatureKey($key, $dateStamp, $regionName, $serviceName) {
    $kSecret = [Text.Encoding]::UTF8.GetBytes(('AWS4' + $key).toCharArray())
    $kDate = HmacSHA256 $dateStamp $kSecret
    $kRegion = HmacSHA256 $regionName $kDate
    $kService = HmacSHA256 $serviceName $kRegion
    $kSigning = HmacSHA256 'aws4_request' $kService

    return $kSigning
}

function hash($request) {
    $hasher = [System.Security.Cryptography.SHA256]::Create()
    $content = [Text.Encoding]::UTF8.GetBytes($request)
    $bytes = $hasher.ComputeHash($content)
    return ($bytes | ForEach-Object ToString x2) -join ''
}
function requestBuilder($method, $key) {

    $now = [DateTime]::UtcNow
    $amz_date = $now.ToString('yyyyMMddTHHmmssZ')
    $datestamp = $now.ToString('yyyyMMdd')

    $signed_headers = 'host'
    $credential_scope = $datestamp + '/' + $region + '/' + $service + '/' + 'aws4_request'

    $canonical_querystring = ''
    $canonical_querystring = 'X-Amz-Algorithm=AWS4-HMAC-SHA256'
    $canonical_querystring += '&X-Amz-Credential=' + [uri]::EscapeDataString(($access_key + '/' + $credential_scope))
    $canonical_querystring += '&X-Amz-Date=' + $amz_date
    $canonical_querystring += '&X-Amz-Expires=86400'
    $canonical_querystring += '&X-Amz-SignedHeaders=' + $signed_headers

    $canonical_headers = 'host:' + $host1 + $br

    $canonical_request = $method + $br
    $canonical_request += '/' + $key + $br
    $canonical_request += $canonical_querystring + $br
    $canonical_request += $canonical_headers + $br
    $canonical_request += $signed_headers + $br
    $canonical_request += 'UNSIGNED-PAYLOAD'

    $algorithm = 'AWS4-HMAC-SHA256'

    $canonical_request_hash = hash -request $canonical_request
    $string_to_sign = $algorithm + $br
    $string_to_sign += $amz_date + $br
    $string_to_sign += $credential_scope + $br
    $string_to_sign += $canonical_request_hash

    $signing_key = getSignatureKey $secret_key $datestamp $region $service
    $signature =  HmacSHA256 -secret $signing_key -message $string_to_sign
    $signature = ($signature|ForEach-Object ToString x2) -join ''

    $canonical_querystring += '&X-Amz-Signature=' + $signature

    $request_url = 'http://' + $host1 + '/' + $key + '?' + $canonical_querystring
    Write-Host $request_url
    return $request_url
}

# Where -InFile is Path/to/xlsx
Invoke-RestMethod -Method PUT -Uri (requestBuilder 'PUT' $keyFile) -InFile $_rawfilename
Start-Sleep -s 2

---

您必须将

x-amz-server-side-encryption

头添加到请求中（

$canonical_头

）

见：

---

在阅读文档时，您需要提供所有3个x-amz服务器端​-加密​-客户算法，x-amz-服务器端​-加密​-客户密钥和x-amz服务器端​-加密​-customer-key-MD5，如果您使用自己的。如果您使用的是Amazon提供的，则可以使用x-amz-server-side​-关于AWS PultS壳的什么？你考虑过用它吗？

$canonical_querystring = ''
$canonical_querystring = 'X-Amz-Algorithm=AWS4-HMAC-SHA256'
$canonical_querystring += '&X-Amz-Credential=' + [uri]::EscapeDataString(($access_key + '/' + $credential_scope))
$canonical_querystring += '&X-Amz-Date=' + $amz_date
$canonical_querystring += '&X-Amz-Expires=86400'
**$canonical_querystring += '&X-amz-server-side-encryption-customer-algorithm=AES256'**
$canonical_querystring += '&X-Amz-SignedHeaders=' + $signed_headers