aws_ssm - apply bucket SSE settings when uploading files to the managed node

[obispobruno]

SUMMARY

Fixes #3018

The aws_ssm connection plugin only generates server-side-encryption settings for fetch_file (node→controller) transfers. For put_file (controller→node) transfers, the put branch of S3ClientManager.generate_host_commands() leaves put_args as None, so the controller-side upload runs upload_fileobj(ExtraArgs=None) and no encryption settings are applied.

When the transfer bucket has a policy that denies unencrypted PutObject requests (e.g. the common DenyIncorrectEncryptionHeader pattern requiring x-amz-server-side-encryption), every controller→node file transfer fails with AccessDenied and the host becomes UNREACHABLE on the first transfer.

This change mirrors the get branch's generate_encryption_settings() call in the put branch, so the returned put_args reach upload_fileobj as ExtraArgs, matching the documented bucket_sse_mode / bucket_sse_kms_key_id behaviour for both transfer directions.

Unit tests updated accordingly: the put cases of test_generate_host_commands now assert that encryption settings are generated and returned (previously they asserted the settings were not generated).

As suggested in #3018 (comment), the integration test setup is also hardened so this can't regress silently: when the connection is configured to send SSE headers (bucket_sse_mode set, i.e. encrypted_bucket without s3_bucket_encryption), the transfer bucket now gets a DenyIncorrectEncryptionHeader policy rejecting any PutObject without the matching x-amz-server-side-encryption header. Default bucket encryption alone can't catch a missing header, because S3 then encrypts the object anyway — which is why connection_aws_ssm_encrypted_s3 previously passed despite this bug.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

aws_ssm

ADDITIONAL INFORMATION

Reproduced with a transfer bucket carrying this policy statement (bucket sse_mode AES256):

{
  "Sid": "DenyIncorrectEncryptionHeader",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::<transfer-bucket>/*",
  "Condition": {
    "StringNotEquals": {
      "s3:x-amz-server-side-encryption": "AES256"
    }
  }
}

Before the fix, every playbook fails on its first file transfer:

fatal: [host]: UNREACHABLE! => ... An error occurred (AccessDenied) when calling the PutObject operation ...

With the fix applied, transfers in both directions succeed. Verified in a live environment (Ubuntu EC2 instance over SSM, bucket_sse_mode: AES256).

[centosinfra-prod-github-app]

Build failed.
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/ansible/buildset/557ac8b757a34bf996fb17af2d22b20a

❌ ansible-galaxy-importer RETRY_LIMIT Host unreachable in 6m 25s
✔️ build-ansible-collection SUCCESS in 10m 00s