Bucket encryption

Encryption

Server-side encryption is opt-in, and it is off until you turn it on. Two ways:

Console
API
CLI
Go

The Default encryption card on the bucket’s Settings tab is a switch and a Save. It sets the bucket default and nothing else — the console’s upload page has no encryption field, so encrypting a single object against a bucket with no default is API only.

Per bucket, which is the one to reach for:

PUT /v1/buckets/{bucket}/encryption
{ "encryption": { "rules": [ { "default": { "sse_algorithm": "AES256" } } ] } }

Or per object, on the write itself:

PUT /v1/buckets/{bucket}/objects/{key}
X-Amz-Server-Side-Encryption: AES256

basaltic storage bucket set-encryption <bucket> --from-file encryption.json

The body is the same JSON the API takes; --from-file - reads stdin.

err := storage.New(cfg).PutBucketEncryption(ctx, bucket,
    &storage.PutBucketEncryptionRequest{Encryption: enc})

The bucket default applies to writes that carry no header of their own — a per-request header wins over it. Only AES256 is supported; aws:kms and customer-provided keys are rejected with a clear error rather than being silently downgraded.

A multipart upload carries no encryption header of its own on each part: the decision is made when the upload is created and survives to the assembled object. Check ServerSideEncryption on a HEAD of the finished object, not on the create response.

Get started

Products

Platform

Help

Bucket encryption

Encryption

​Encryption

Encryption