如何使用Java AWS SDK创建带KMS加密的S3存储桶？

AI 小北

2026-5-20

当然有对应的实现方法！不管你用的是AWS SDK for Java的V1还是现在官方更推荐的V2版本，都能完成创建带KMS加密的S3存储桶操作。我之前做过类似需求，下面分版本给你详细说明：

AWS SDK for Java V2（推荐使用）

首先确保项目里引入了S3相关的V2依赖，然后通过CreateBucketRequest配置KMS加密规则即可，核心是设置ServerSideEncryptionConfiguration。

示例代码如下：

import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.s3.S3Client;
import software.amazon.awssdk.services.s3.model.CreateBucketRequest;
import software.amazon.awssdk.services.s3.model.ServerSideEncryptionConfiguration;
import software.amazon.awssdk.services.s3.model.ServerSideEncryptionRule;
import software.amazon.awssdk.services.s3.model.ServerSideEncryptionByDefault;

public class CreateEncryptedBucket {
    public static void main(String[] args) {
        String bucketName = "your-custom-bucket-name";
        String kmsKeyId = "your-kms-key-id-or-arn"; // 支持KMS密钥ID、完整ARN或别名（比如alias/my-kms-key）
        Region region = Region.US_EAST_1;

        try (S3Client s3 = S3Client.builder().region(region).build()) {
            // 构建默认加密规则：指定使用KMS密钥
            ServerSideEncryptionByDefault sseByDefault = ServerSideEncryptionByDefault.builder()
                    .sseAlgorithm("aws:kms")
                    .kmsMasterKeyId(kmsKeyId)
                    .build();

            ServerSideEncryptionRule encryptionRule = ServerSideEncryptionRule.builder()
                    .applyServerSideEncryptionByDefault(sseByDefault)
                    .build();

            ServerSideEncryptionConfiguration encryptionConfig = ServerSideEncryptionConfiguration.builder()
                    .rules(encryptionRule)
                    .build();

            // 创建带加密配置的存储桶请求
            CreateBucketRequest bucketRequest = CreateBucketRequest.builder()
                    .bucket(bucketName)
                    .serverSideEncryptionConfiguration(encryptionConfig)
                    .build();

            s3.createBucket(bucketRequest);
            System.out.println("Bucket " + bucketName + " created with KMS encryption enabled successfully");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

几个关键注意点：

sseAlgorithm必须指定为aws:kms，这是区别于S3默认SSE-S3加密的核心
要确保你的IAM身份（角色/用户）拥有创建S3桶的权限，以及使用指定KMS密钥的相关权限（比如kms:Encrypt、kms:Decrypt等）
如果不指定kmsMasterKeyId，S3会自动使用AWS管理的默认KMS密钥，但推荐使用自定义密钥提升可控性

AWS SDK for Java V1（旧版本）

如果还在维护基于V1的旧项目，同样可以实现，写法略有不同：

import com.amazonaws.auth.DefaultAWSCredentialsProviderChain;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;
import com.amazonaws.services.s3.model.CreateBucketRequest;
import com.amazonaws.services.s3.model.ServerSideEncryptionConfiguration;
import com.amazonaws.services.s3.model.ServerSideEncryptionRule;
import com.amazonaws.services.s3.model.ServerSideEncryptionByDefault;

public class CreateEncryptedBucketV1 {
    public static void main(String[] args) {
        String bucketName = "your-custom-bucket-name";
        String kmsKeyId = "your-kms-key-id-or-arn";
        Regions region = Regions.US_EAST_1;

        AmazonS3 s3Client = AmazonS3ClientBuilder.standard()
                .withRegion(region)
                .withCredentials(new DefaultAWSCredentialsProviderChain())
                .build();

        ServerSideEncryptionByDefault sseByDefault = new ServerSideEncryptionByDefault()
                .withSSEAlgorithm("aws:kms")
                .withKMSMasterKeyID(kmsKeyId);

        ServerSideEncryptionRule encryptionRule = new ServerSideEncryptionRule()
                .withApplyServerSideEncryptionByDefault(sseByDefault);

        ServerSideEncryptionConfiguration encryptionConfig = new ServerSideEncryptionConfiguration()
                .withRules(encryptionRule);

        CreateBucketRequest bucketRequest = new CreateBucketRequest(bucketName)
                .withServerSideEncryptionConfiguration(encryptionConfig);

        s3Client.createBucket(bucketRequest);
        System.out.println("Bucket created with KMS encryption successfully");
    }
}