Skip to content

Instantly share code, notes, and snippets.

@imbradbrown

imbradbrown/upload-ssec.sh

Last active July 27, 2025 12:00
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save imbradbrown/df9e75e1202efacf70f0 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save imbradbrown/df9e75e1202efacf70f0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Brad Brown renamed this gist Apr 20, 2015. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.sh → upload-ssec.sh
    View file
    File renamed without changes.
  2. Brad Brown renamed this gist Apr 20, 2015. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → gistfile1.sh
    View file
    File renamed without changes.
  3. Brad Brown created this gist Apr 20, 2015.
    42 changes: 42 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,42 @@
    #!/bin/bash

    ## file to upload.
    S3_UPLOAD_FILE=some/path/file.txt

    ## Specify the bucket name here. This can be found in the S3 console
    S3_BUCKET=bucket name here

    ## The desired path relative to the root of the bucket. All folders must be forward slash '/' separated
    S3_DESTINATION_FILE=folder/folder2/file.txt

    ## The Admin Access Key for the account found on https://console.aws.amazon.com/iam/home#security_credential
    S3_KEY=Amazon Admin Access Key

    ## The Admin Access Secret Key for the account found on https://console.aws.amazon.com/iam/home#security_credential
    S3_SECRET= Secret Key Here

    ## the content type to post.
    S3_CONTENT_TYPE="application/octet-stream"

    ## The date formatted in GMT
    S3_DATE="$(LC_ALL=C date -u +"%a, %d %b %Y %X %z")"

    ## calculate the MD5 of the file to upload and BASE64 encode it
    S3_MD5SUM="$(openssl md5 -binary < ${S3_UPLOAD_FILE} | base64)"

    S3_SSEC_ALGORITHM=AES256

    ## The Server Side Encryption - Customer Provided Key to use. This must be 32 bytes in length
    S3_SSEC_KEY=00000000000000000000000000012345

    ## Base64 encode the SSE-C key. This is used as the x-amz-server-side-encryption-customer-key
    S3_ENCRYPTION_KEY="$(echo -n ${S3_SSEC_KEY} | openssl enc -base64)"

    ## MD5 hash the SSE-C key. Base64 the result. This is used as the x-amz-server-side-encryption-customer-key-MD5
    S3_ENCRYPTION_MD5="$(echo -n ${S3_SSEC_KEY} | openssl dgst -md5 -binary | openssl enc -base64)"

    ## S3 validates the request by checking the data passed in is in a specific order. See http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-authentication-HTTPPOST.html
    S3_SIGNATURE="$(printf "PUT\n$S3_MD5SUM\n$S3_CONTENT_TYPE\n$S3_DATE\nx-amz-server-side-encryption-customer-algorithm:$S3_SSEC_ALGORITHM\nx-amz-server-side-encryption-customer-key:$S3_ENCRYPTION_KEY\nx-amz-server-side-encryption-customer-key-md5:$S3_ENCRYPTION_MD5\n/$S3_BUCKET/$S3_DESTINATION_FILE" | openssl sha1 -binary -hmac "$S3_SECRET" | base64)"

    ## Send the actual curl
    curl -v -T ${S3_UPLOAD_FILE} https://$S3_BUCKET.s3.amazonaws.com/${S3_DESTINATION_FILE} -H "Date: ${S3_DATE}" -H "Authorization: AWS ${S3_KEY}:${S3_SIGNATURE}" -H "Content-Type: ${S3_CONTENT_TYPE}" -H "Content-MD5: ${S3_MD5SUM}" -H "x-amz-server-side-encryption-customer-algorithm:${S3_SSEC_ALGORITHM}" -H "x-amz-server-side-encryption-customer-key:${S3_ENCRYPTION_KEY}" -H "x-amz-server-side-encryption-customer-key-MD5:${S3_ENCRYPTION_MD5}"