Support KMS encryption context for S3 transfer commands

awscli/customizations/s3/subcommands.py

@@ -218,6 +218,19 @@
 }
 
 
+SSE_KMS_ENCRYPTION_CONTEXT = {
+ 'name': 'sse-kms-encryption-context',
+ 'help_text': (
+ 'Specifies the Amazon Web Services KMS Encryption Context to use for'
+ 'object encryption. The value of this header is a base64-encoded'
+ 'UTF-8 string holding JSON with the encryption context key-value'
+ 'pairs. This value is stored as object metadata and automatically'
+ 'gets passed on to Amazon Web Services KMS for future GetObject or'
+ 'CopyObject operations on this object.'
+ )
+}
+
+
 SSE_C_COPY_SOURCE = {
  'name': 'sse-c-copy-source', 'nargs': '?',
  'const': 'AES256', 'choices': ['AES256'],
@@ -432,7 +445,8 @@
 
 TRANSFER_ARGS = [DRYRUN, QUIET, INCLUDE, EXCLUDE, ACL,
  FOLLOW_SYMLINKS, NO_FOLLOW_SYMLINKS, NO_GUESS_MIME_TYPE,
- SSE, SSE_C, SSE_C_KEY, SSE_KMS_KEY_ID, SSE_C_COPY_SOURCE,
+ SSE, SSE_C, SSE_C_KEY, SSE_KMS_KEY_ID,
+ SSE_KMS_ENCRYPTION_CONTEXT, SSE_C_COPY_SOURCE,
  SSE_C_COPY_SOURCE_KEY, STORAGE_CLASS, GRANTS,
  WEBSITE_REDIRECT, CONTENT_TYPE, CACHE_CONTROL,
  CONTENT_DISPOSITION, CONTENT_ENCODING, CONTENT_LANGUAGE,

awscli/customizations/s3/utils.py

@@ -601,8 +601,10 @@ def _set_metadata_directive_param(cls, request_params, cli_params):
  def _set_sse_request_params(cls, request_params, cli_params):
  if cli_params.get('sse'):
  request_params['ServerSideEncryption'] = cli_params['sse']
- if  cli_params.get('sse_kms_key_id'):
+ if cli_params.get('sse_kms_key_id'):
  request_params['SSEKMSKeyId'] = cli_params['sse_kms_key_id']
+ if cli_params.get('sse_kms_encryption_context'):
+ request_params['SSEKMSEncryptionContext'] = cli_params['sse_kms_encryption_context']
 
  @classmethod
  def _set_sse_c_request_params(cls, request_params, cli_params):