m

Author: rishav-karanjit

src/main/java/software/amazon/encryption/s3/internal/PutEncryptedObjectPipeline.java

@@ -84,7 +84,7 @@ public CompletableFuture<PutObjectResponse> putObject(PutObjectRequest request,
                 .overrideConfiguration(API_NAME_INTERCEPTOR)
                 .contentLength(encryptedContent.getCiphertextLength())
                 .build();
-        return _s3AsyncClient.putObject(encryptedPutRequest, encryptedContent.getAsyncCiphertext());
+        return _s3AsyncClient.putObject(encryptedPutRequest, new NoRetriesAsyncRequestBody(encryptedContent.getAsyncCiphertext()));
     }
 
     public static class Builder {

src/test/java/software/amazon/encryption/s3/S3EncryptionClientTest.java

@@ -17,6 +17,7 @@
 import com.amazonaws.services.s3.model.StaticEncryptionMaterialsProvider;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 import org.junitpioneer.jupiter.RetryingTest;
 import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
 import software.amazon.awssdk.auth.credentials.AwsSessionCredentials;
@@ -966,7 +967,7 @@ public void s3EncryptionClientTopLevelCredentialsWrongRegion() {
         }
     }
 
-    @RetryingTest(3)
+    @Test
     public void crossRegionRoundTrip() {
         final String objectKey = appendTestSuffix("cross-region-test");
         SecretKeySpec aesKey = new SecretKeySpec(new byte[32], "AES");
@@ -980,14 +981,12 @@ public void crossRegionRoundTrip() {
 
         try {
             PutObjectRequest request = PutObjectRequest.builder().bucket(BUCKET).key(objectKey).build();
-            s3.putObject(request, RequestBody.fromBytes("test".getBytes()));
-            ResponseBytes<GetObjectResponse> response = s3.getObjectAsBytes(builder -> builder
-                    .bucket(BUCKET)
-                    .key(objectKey)
-                    .build());
-            assertEquals("test", response.asUtf8String());
+            S3EncryptionClientException ex = assertThrows(S3EncryptionClientException.class, () ->
+                    s3.putObject(request, RequestBody.fromBytes("test".getBytes())));
+            // Cross-region redirect causes the SDK to re-subscribe to the request body.
+            // NoRetriesAsyncRequestBody blocks this to prevent GCM cipher key/IV reuse.
+            assertTrue(ex.getMessage().contains("Re-subscription is not supported"));
         } finally {
-            deleteObject(BUCKET, objectKey, s3);
             s3.close();
         }
     }