feat(storage): migrate encryption samples and tests

storage/changeFileCSEKToCMEK.js

@@ -0,0 +1,89 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+'use strict';
+
+// sample-metadata:
+//   title: Storage File Convert CSEK to CMEK.
+//   description: Storage File Convert CSEK to CMEK.
+//   usage: node changeFileCSEKToCMEK.js <BUCKET_NAME> <FILE_NAME> <ENCRYPTION_KEY> <KMS_KEY_NAME>
+
+function main(
+  bucketName = 'my-bucket',
+  fileName = 'test.txt',
+  encryptionKey = 'my-encription-key',
+  kmsKeyName = 'my-kms-key',
+  generationMatchPrecondition = 0
+) {
+  // [START storage_object_csek_to_cmek]
+  /**
+   * TODO(developer): Uncomment the following lines before running the sample.
+   */
+  // The ID of your GCS bucket
+  // const bucketName = 'your-unique-bucket-name';
+
+  // The ID of your GCS file
+  // const fileName = 'your-file-name';
+
+  // The Base64 encoded decryption key, which should be the same key originally
+  // used to encrypt the file
+  // const encryptionKey = 'TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g=';
+
+  // The name of the KMS key to manage this file with
+  // const kmsKeyName = 'projects/your-project-id/locations/global/keyRings/your-key-ring/cryptoKeys/your-key';
+
+  // Imports the Google Cloud client library
+  const {Storage} = require('@google-cloud/storage');
+
+  // Creates a client
+  const storage = new Storage();
+
+  async function changeFileCSEKToCMEK() {
+    try {
+      const rotateEncryptionKeyOptions = {
+        kmsKeyName,
+        // Optional: set a generation-match precondition to avoid potential race
+        // conditions and data corruptions. The request to copy is aborted if the
+        // object's generation number does not match your precondition.
+        preconditionOpts: {
+          ifGenerationMatch: generationMatchPrecondition,
+        },
+      };
+
+      console.log(rotateEncryptionKeyOptions);
+
+      await storage
+        .bucket(bucketName)
+        .file(fileName, {
+          encryptionKey: Buffer.from(encryptionKey, 'base64'),
+        })
+        .rotateEncryptionKey({
+          rotateEncryptionKeyOptions,
+        });
+
+      console.log(
+        `file ${fileName} in bucket ${bucketName} is now managed by KMS key ${kmsKeyName} instead of customer-supplied encryption key`
+      );
+    } catch (error) {
+      console.error(
+        'Error executing change file CSEK to CMEK:',
+        error.message || error
+      );
+    }
+  }
+
+  changeFileCSEKToCMEK();
+  // [END storage_object_csek_to_cmek]
+}
+main(...process.argv.slice(2));

storage/downloadEncryptedFile.js

@@ -0,0 +1,82 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+'use strict';
+
+/**
+ * This application demonstrates how to perform basic operations on encrypted
+ * files with the Google Cloud Storage API.
+ *
+ * For more information, see the README.md under /storage and the documentation
+ * at https://cloud.google.com/storage/docs.
+ */
+
+const path = require('path');
+
+function main(
+  bucketName = 'my-bucket',
+  srcFileName = path.join(__dirname, '../resources', 'test.txt'),
+  destFileName = 'test.txt',
+  encryptionKey = process.env.GOOGLE_CLOUD_KMS_KEY_US
+) {
+  // [START storage_download_encrypted_file]
+  /**
+   * TODO(developer): Uncomment the following lines before running the sample.
+   */
+  // The ID of your GCS bucket
+  // const bucketName = 'your-unique-bucket-name';
+
+  // The ID of your GCS file
+  // const srcFileName = 'your-file-name';
+
+  // The path to which the file should be downloaded
+  // const destFileName = '/local/path/to/file.txt';
+
+  // The Base64 encoded decryption key, which should be the same key originally
+  // used to encrypt the file
+  // const encryptionKey = 'TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g=';
+
+  // Imports the Google Cloud client library
+  const {Storage} = require('@google-cloud/storage');
+
+  // Creates a client
+  const storage = new Storage();
+
+  async function downloadEncryptedFile() {
+    try {
+      const options = {
+        destination: destFileName,
+      };
+
+      // Decrypts and downloads the file. This can only be done with the key used
+      // to encrypt and upload the file.
+      await storage
+        .bucket(bucketName)
+        .file(srcFileName)
+        .setEncryptionKey(Buffer.from(encryptionKey, 'base64'))
+        .download(options);
+
+      console.log(`File ${srcFileName} downloaded to ${destFileName}`);
+    } catch (error) {
+      console.error(
+        'Error executing download encrypted file:',
+        error.message || error
+      );
+    }
+  }
+
+  downloadEncryptedFile();
+  // [END storage_download_encrypted_file]
+}
+main(...process.argv.slice(2));

storage/generateEncryptionKey.js

@@ -0,0 +1,52 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+'use strict';
+
+/**
+ * This application demonstrates how to perform basic operations on encrypted
+ * files with the Google Cloud Storage API.
+ *
+ * For more information, see the README.md under /storage and the documentation
+ * at https://cloud.google.com/storage/docs.
+ */
+
+function main() {
+  // [START storage_generate_encryption_key]
+  const crypto = require('crypto');
+
+  function generateEncryptionKey() {
+    try {
+      /**
+       * Generates a 256 bit (32 byte) AES encryption key and prints the base64
+       * representation.
+       *
+       * This is included for demonstration purposes. You should generate your own
+       * key. Please remember that encryption keys should be handled with a
+       * comprehensive security policy.
+       */
+      const buffer = crypto.randomBytes(32);
+      const encodedKey = buffer.toString('base64');
+      console.log(`Base 64 encoded encryption key: ${encodedKey}`);
+    } catch (error) {
+      console.error(
+        'Error executing generate encryption key:',
+        error.message || error
+      );
+    }
+  }
+  generateEncryptionKey();
+  // [END storage_generate_encryption_key]
+}
+main(...process.argv.slice(2));

storage/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@google-cloud/storage-samples",
+  "description": "Samples for the Cloud Storage Client Library for Node.js.",
+  "license": "Apache-2.0",
+  "author": "Google Inc.",
+  "engines": {
+    "node": ">=12"
+  },
+  "repository": "googleapis/nodejs-storage",
+  "private": true,
+  "files": [
+    "*.js"
+  ],
+  "scripts": {
+    "cleanup": "node scripts/cleanup",
+    "test": "mocha system-test/*.js --timeout 800000"
+  },
+  "dependencies": {
+    "@google-cloud/pubsub": "^4.0.0",
+    "@google-cloud/storage": "^7.19.0",
+    "node-fetch": "^2.6.7",
+    "uuid": "^8.0.0",
+    "yargs": "^16.0.0"
+  },
+  "devDependencies": {
+    "chai": "^4.2.0",
+    "mocha": "^8.0.0",
+    "p-limit": "^3.1.0"
+  }
+}

storage/resources/.gitignore

@@ -0,0 +1 @@
+downloaded.txt

storage/resources/resourcesSub1/testSub1.txt

@@ -0,0 +1,2 @@
+Sub1
+Hello World!

storage/resources/test.txt

@@ -0,0 +1 @@
+Hello World!

storage/resources/test2.txt

@@ -0,0 +1 @@
+Hello World 2!

storage/rotateEncryptionKey.js

@@ -0,0 +1,91 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+'use strict';
+
+/**
+ * This application demonstrates how to perform basic operations on encrypted
+ * files with the Google Cloud Storage API.
+ *
+ * For more information, see the README.md under /storage and the documentation
+ * at https://cloud.google.com/storage/docs.
+ */
+
+function main(
+  bucketName = 'my-bucket',
+  fileName = 'test.txt',
+  oldKey = process.env.GOOGLE_CLOUD_KMS_KEY_US,
+  newKey = process.env.GOOGLE_CLOUD_KMS_KEY_ASIA,
+  generationMatchPrecondition = 0
+) {
+  // [START storage_rotate_encryption_key]
+  /**
+   * TODO(developer): Uncomment the following lines before running the sample.
+   */
+  // The ID of your GCS bucket
+  // const bucketName = 'your-unique-bucket-name';
+
+  // The ID of your GCS file
+  // const fileName = 'your-file-name';
+
+  // The Base64 encoded AES-256 encryption key originally used to encrypt the
+  // object. See the documentation on Customer-Supplied Encryption keys for
+  // more info:
+  // https://cloud.google.com/storage/docs/encryption/using-customer-supplied-keys
+  // The Base64 encoded AES-256 encryption key originally used to encrypt the
+  // const oldKey = 'TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g=';
+
+  // The new encryption key to use
+  // const newKey = '0mMWhFvQOdS4AmxRpo8SJxXn5MjFhbz7DkKBUdUIef8=';
+
+  // Imports the Google Cloud client library
+  const {Storage} = require('@google-cloud/storage');
+
+  // Creates a client
+  const storage = new Storage();
+
+  async function rotateEncryptionKey() {
+    try {
+      const rotateEncryptionKeyOptions = {
+        encryptionKey: Buffer.from(newKey, 'base64'),
+
+        // Optional: set a generation-match precondition to avoid potential race
+        // conditions and data corruptions. The request to copy is aborted if the
+        // object's generation number does not match your precondition.
+        preconditionOpts: {
+          ifGenerationMatch: generationMatchPrecondition,
+        },
+      };
+      await storage
+        .bucket(bucketName)
+        .file(fileName, {
+          encryptionKey: Buffer.from(oldKey, 'base64'),
+        })
+        .rotateEncryptionKey({
+          rotateEncryptionKeyOptions,
+        });
+
+      console.log('Encryption key rotated successfully');
+    } catch (error) {
+      console.error(
+        'Error executing rotate encryption key:',
+        error.message || error
+      );
+    }
+  }
+
+  rotateEncryptionKey();
+  // [END storage_rotate_encryption_key]
+}
+main(...process.argv.slice(2));