-
Notifications
You must be signed in to change notification settings - Fork 767
[RUN-3090] Update for s3 sdk changes. #10550
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
MarkvanMents
merged 12 commits into
mendix:development
from
emirmx:run/3090-update-for-s3-sdk-changes
Jan 8, 2026
Merged
Changes from all commits
Commits
Show all changes
12 commits
Select commit
Hold shift + click to select a range
b6c47e2
Update runtime settings documentation to reflect S3 SDK update changes
emirmx be64a59
Merge branch 'mendix:development' into run/3090-update-for-s3-sdk-cha…
emirmx 2019fb0
Merge branch 'mendix:development' into run/3090-update-for-s3-sdk-cha…
emirmx 84ed2b1
Update runtime settings documentation to reflect S3 SDK update changes
emirmx 35053a4
Proofread Custom Setting and correct URLs
MarkvanMents 2a7db55
Move files under custom-settings
MarkvanMents cf05d67
Proofread s3 encryption key update
MarkvanMents bcc2221
Update content/en/docs/refguide/runtime/custom-settings/s3-encryption…
emirmx c923b11
Move s3 encryption key setting example to key update doc
emirmx df7d3de
Update batch-file-update-microflow.png
emirmx 12d8d67
Move s3 encryption key setting example to key update doc (refguide, r…
emirmx b517073
Ensure Mx9 and Mx10 versions match Mx11 version
MarkvanMents File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
69 changes: 69 additions & 0 deletions
69
content/en/docs/refguide/runtime/custom-settings/s3-encryption-key-update.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| --- | ||
| title: "Updating Encryption Keys for S3 File Storage" | ||
| url: /refguide/s3-encryption-key-update/ | ||
| description: "Describes how to add a new encryption key and re-encrypt all existing files on S3 storage." | ||
| --- | ||
|
|
||
| ## Introduction | ||
|
|
||
| Client side encryption for S3 can be enabled by specifying encryption keys with the `com.mendix.storage.s3.EncryptionKeys` setting. This setting allows you to specify multiple keys. | ||
| The last encryption key will be used for encrypting new files. When retrieving a file the correct encryption key will be used from the list of encryption keys. | ||
|
|
||
| A sample value for the setting would be: | ||
|
|
||
| ```json | ||
| [ | ||
| { | ||
| "keyID": "first", | ||
| "algorithm": "AES", | ||
| "key": "IauTCIvTCZ4iy4jm4rzjmYXBLlFgP3hCVKxjXIcBX0Q=" | ||
| }, | ||
| { | ||
| "keyID": "first", | ||
| "algorithm": "AES", | ||
| "key": "Eu9O519OaDgtiSSpNoXM51eDjc0UIHHxBfXukR5Cyqw=" | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| {{% alert color="warning" %}} | ||
| For deployments to Mendix Cloud, SAP BTP, and Mendix on Kubernetes, these encryption keys are managed for you and cannot be changed. | ||
| {{% /alert %}} | ||
|
|
||
| ## Implementing Key Rotation | ||
|
|
||
| When a new key is added, that key will be used for newly encrypted files but existing files will *not* be automatically re-encrypted. For this you need to implement re-encryption inside your application. | ||
| This can be done by adding a new encryption key and then re-uploading all existing files. | ||
|
|
||
| The following is a Java action that demonstrates re-uploading a list of files: | ||
|
|
||
| ```java | ||
| public class JA_RefreshFileContents extends UserAction<java.lang.Void> | ||
| { | ||
| … | ||
| private final java.util.List<IMendixObject> __files; | ||
|
|
||
| … | ||
| public java.lang.Void executeAction() throws Exception | ||
| { | ||
| // BEGIN USER CODE | ||
| IContext sc = Core.createSystemContext(); | ||
| sc.startTransaction(); | ||
| __files.stream().forEach(f -> { f.setValue(sc, "Contents", (java.io.InputStream) f.getValue(sc, "Contents")); }); | ||
| sc.endTransaction(); | ||
| Core.commit(sc, __files); | ||
| return null; | ||
| // END USER CODE | ||
| } | ||
|
|
||
| … | ||
| } | ||
| ``` | ||
|
|
||
| This Java action can be repeatedly called from a microflow that reads objects of type `System.FileDocument`' in batches. For example, see the following microflow: | ||
|
|
||
| {{< figure src="/attachments/refguide9/runtime/custom-settings/batch-file-update-microflow.png" class="no-border" alt="Microflow which contains a loop which retrieves a list of FileDocument objects and rewrites them to rotate the encryption key." >}} | ||
|
|
||
| Here, a list of FileDocument objects is retrieved, for example 100, ordered by the `FileID` attribute, and passed to the `JA_RefreshFileContents` Java action. This is repeated until all the batches of files are processed. The microflow logs and stores the `FileID` attribute of the last processed file in each batch in case the process gets interrupted. | ||
|
|
||
| This microflow can be executed in a task queue. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
69 changes: 69 additions & 0 deletions
69
content/en/docs/refguide10/runtime/custom-settings/s3-encryption-key-update.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| --- | ||
| title: "Updating Encryption Keys for S3 File Storage" | ||
| url: /refguide10/s3-encryption-key-update/ | ||
| description: "Describes how to add a new encryption key and re-encrypt all existing files on S3 storage." | ||
| --- | ||
|
|
||
| ## Introduction | ||
|
|
||
| Client side encryption for S3 can be enabled by specifying encryption keys with the `com.mendix.storage.s3.EncryptionKeys` setting. This setting allows you to specify multiple keys. | ||
| The last encryption key will be used for encrypting new files. When retrieving a file the correct encryption key will be used from the list of encryption keys. | ||
|
|
||
| A sample value for the setting would be: | ||
|
|
||
| ```json | ||
| [ | ||
| { | ||
| "keyID": "first", | ||
| "algorithm": "AES", | ||
| "key": "IauTCIvTCZ4iy4jm4rzjmYXBLlFgP3hCVKxjXIcBX0Q=" | ||
| }, | ||
| { | ||
| "keyID": "first", | ||
| "algorithm": "AES", | ||
| "key": "Eu9O519OaDgtiSSpNoXM51eDjc0UIHHxBfXukR5Cyqw=" | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| {{% alert color="warning" %}} | ||
| For deployments to Mendix Cloud, SAP BTP, and Mendix on Kubernetes, these encryption keys are managed for you and cannot be changed. | ||
| {{% /alert %}} | ||
|
|
||
| ## Implementing Key Rotation | ||
|
|
||
| When a new key is added, that key will be used for newly encrypted files but existing files will *not* be automatically re-encrypted. For this you need to implement re-encryption inside your application. | ||
| This can be done by adding a new encryption key and then re-uploading all existing files. | ||
|
|
||
| The following is a Java action that demonstrates re-uploading a list of files: | ||
|
|
||
| ```java | ||
| public class JA_RefreshFileContents extends UserAction<java.lang.Void> | ||
| { | ||
| … | ||
| private final java.util.List<IMendixObject> __files; | ||
|
|
||
| … | ||
| public java.lang.Void executeAction() throws Exception | ||
| { | ||
| // BEGIN USER CODE | ||
| IContext sc = Core.createSystemContext(); | ||
| sc.startTransaction(); | ||
| __files.stream().forEach(f -> { f.setValue(sc, "Contents", (java.io.InputStream) f.getValue(sc, "Contents")); }); | ||
| sc.endTransaction(); | ||
| Core.commit(sc, __files); | ||
| return null; | ||
| // END USER CODE | ||
| } | ||
|
|
||
| … | ||
| } | ||
| ``` | ||
|
|
||
| This Java action can be repeatedly called from a microflow that reads objects of type `System.FileDocument`' in batches. For example, see the following microflow: | ||
|
|
||
| {{< figure src="/attachments/refguide9/runtime/custom-settings/batch-file-update-microflow.png" class="no-border" alt="Microflow which contains a loop which retrieves a list of FileDocument objects and rewrites them to rotate the encryption key." >}} | ||
|
|
||
| Here, a list of FileDocument objects is retrieved, for example 100, ordered by the `FileID` attribute, and passed to the `JA_RefreshFileContents` Java action. This is repeated until all the batches of files are processed. The microflow logs and stores the `FileID` attribute of the last processed file in each batch in case the process gets interrupted. | ||
|
|
||
| This microflow can be executed in a task queue. |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.