Encryption
Object Storage supports server-side encryption using service-managed keys and user keys (SSE-KMS). You can select the encryption method when creating a bucket, and changes are limited under certain conditions.
When using SSE-KMS, access permission for the KMS user key is required in addition to bucket permissions. Before selecting or changing an encryption method, review the behavior and limitations of each encryption method.
Encryption type comparison
| Encryption type | Key manager | Encryption algorithm | Description |
|---|---|---|---|
| Service-managed key | Object Storage service | AES256 | - Encrypts objects using a key automatically managed by the service - Automatically applies encryption to all objects without separate key management |
| User key (SSE-KMS) | User (KMS user key) | AES256 | - Encrypts the bucket using a user key created directly by the user in KMS - Provides full control over the key and supports auditing key usage history |
Configure bucket encryption
When creating a bucket, you can select the server-side encryption method to apply to stored objects. The encryption method can be changed, but objects uploaded before and after the change may use different encryption keys.
Encryption setting changes and limitations
When changing encryption settings, review the following behavior and limitations.
| Item | Description |
|---|---|
| Based on upload time | - Objects follow the encryption settings at the time of upload - Changing the default bucket encryption method does not change the encryption method of existing objects |
| Encryption method change supported | - Default encryption method can be changed between Service-managed key and SSE-KMS - Available regardless of bucket usage |
| Encrypted to unencrypted not supported | An encrypted bucket cannot be changed to an unencrypted bucket |
| Unencrypted to encrypted condition | Available only when bucket usage in bytes is 0 |
| SSE-C not supported | Customer-provided keys (SSE-C) are not supported, and a 501 response is returned when related headers are used |
| DeleteBucketEncryption not supported | Deleting bucket encryption settings is not supported, and a 403 response is returned for requests |
- Uploads immediately after configuring user key (SSE-KMS): After configuring user key (SSE-KMS) encryption for a bucket, it may take a short time for the encryption settings to be fully applied. Objects uploaded during this time may be encrypted with a service-managed key. We recommend waiting briefly after configuring encryption before uploading objects.
- KMS user key access permission: After changing the encryption method, you must have access permissions for the KMS user keys used for objects uploaded before and after the change to decrypt them properly.
SSE-KMS requirements
To upload or retrieve objects in a bucket encrypted with SSE-KMS, the following permissions are required. Access is denied if any permission is missing.
| Required permission | Description |
|---|---|
| KMS role | A role that can perform encryption operations using a KMS key.KMS User or higher permission is required.For details, refer to KMS roles. |
| Access control permission for the KMS user key | Access permission for the KMS user key used for bucket encryption. KMS user key access control permission can be granted only to targets in the same project. For details about KMS key access control, refer to the KMS service guide. |
When accessing an SSE-KMS-encrypted object through a presigned URL, the credentials that generate the presigned URL must also have access permission for the KMS user key.
Users outside the project cannot be added directly to KMS user key access control. First, add the user to the project by granting the Object Storage role and KMS role required for object access.
After that, add the user to KMS user key access control so the user can access SSE-KMS-encrypted objects.
KMS key states and encryption behavior
Whether objects in an SSE-KMS-encrypted bucket can be encrypted or decrypted depends on the state of the KMS user key.
| KMS key state | Description | Encrypt new objects | Decrypt existing objects |
|---|---|---|---|
| Pre-activation | The key has been created, but no active version exists. | Not available | Not available |
| Active | Encryption and decryption operations can be performed. | Available | Available |
| Deactivated | The key is deactivated, so new encryption is not available, but existing data can be decrypted. | Not available | Available |
| Destroyed | The version is permanently deleted and cannot be recovered. | Not available | Not available |
If a KMS user key enters the Deactivated or Destroyed state, you cannot upload new objects to buckets encrypted with that key. In the Destroyed state, existing objects also cannot be decrypted, so the data becomes permanently inaccessible.
For details about KMS key states, see KMS key states.