Encryption
Configure bucket encryption
To protect objects stored in a bucket, you can select a server-side encryption method when creating the bucket.
Encryption type comparison
| Encryption type | Key manager | Encryption algorithm | Description |
|---|---|---|---|
| Service-managed key | Object Storage service | AES256 | Encrypts objects using a key automatically managed by the service. Encryption is automatically applied to all objects without separate key management. |
| User key (SSE-KMS) | User (KMS user key) | AES256 | Encrypts the bucket using a user key that you create directly in the KMS service. You retain full control over the key and can audit its usage history. |
- You can change the encryption method of a bucket. Objects are encrypted according to the encryption method at the time of upload, so objects uploaded before and after the change may use different encryption keys.
- Uploads immediately after configuring user key (SSE-KMS): After configuring user key (SSE-KMS) encryption for a bucket, it may take a short time for the encryption settings to be fully applied.
Objects uploaded during this time may be encrypted with a service-managed key. We recommend waiting briefly after configuring encryption before uploading objects. - After changing the encryption method, you must have access permissions for the KMS user keys used for both objects uploaded before the change and objects uploaded after the change to decrypt them properly.
- If a KMS user key is deactivated or destroyed, objects in buckets encrypted with that key cannot be accessed.
SSE-KMS requirements
To upload or retrieve objects in a bucket encrypted with SSE-KMS, the requester's credentials must have both of the following permissions.
Access is denied if either permission is missing.
| Required permission | Description |
|---|---|
| IAM role for the KMS service | The minimum IAM role required to perform encryption operations using a key in the KMS service. For details, refer to KMS roles. |
| Access control permission for the KMS user key | Access permission for the KMS user key used for bucket encryption. For details about KMS key access control, refer to the KMS service guide. |
When accessing an SSE-KMS-encrypted object through a presigned URL, the credentials that generate the presigned URL must also have access permission for the KMS user key.
Bucket permissions can be granted to all users in a domain, including users outside the project. However, access control permissions for KMS user keys can be granted only to users in the project.
Therefore, even if you grant access to an SSE-KMS-encrypted bucket to a user outside the project, that user cannot access encrypted objects because they cannot receive access permission for the KMS user key.
Solution
- Invite the user as a project member: Invite the external user as a member of the project, then add the user to access control for the KMS user key.
KMS key states and encryption behavior
Whether objects in an SSE-KMS-encrypted bucket can be encrypted or decrypted depends on the state of the KMS user key.
| KMS key state | Description | Encrypt new objects | Decrypt existing objects |
|---|---|---|---|
| Pre-activation | The key has been created, but no active version exists. | Not available | Not available |
| Active | Encryption and decryption operations can be performed. | Available | Available |
| Deactivated | The key is deactivated, so new encryption is not available, but existing data can be decrypted. | Not available | Available |
| Destroyed | The version is permanently deleted and cannot be recovered. | Not available | Not available |
If a KMS user key enters the Deactivated or Destroyed state, you cannot upload new objects to buckets encrypted with that key. In the Destroyed state, existing objects also cannot be decrypted, so the data becomes permanently inaccessible.
For details about KMS key states, refer to KMS key states.
Encryption notes
- Uploads immediately after configuring user key (SSE-KMS): After configuring user key (SSE-KMS) encryption for a bucket, it may take a short time for the encryption settings to be fully applied. Objects uploaded during this time may be encrypted with a service-managed key. We recommend waiting briefly after configuring encryption before uploading objects.
- Based on upload time: Objects follow the encryption settings at the time of upload. Changing the default encryption method of a bucket does not change the encryption method of objects that were already uploaded.
- Cannot switch from encrypted to unencrypted: An encrypted bucket cannot be changed to an unencrypted bucket.
- Switching from unencrypted to encrypted: This is available only when the bucket usage in bytes is 0.
- Changing encryption method: You can freely change the default encryption method between Service-managed key and SSE-KMS, regardless of bucket usage.
- SSE-C not supported: Customer-provided keys (SSE-C) are not supported. A 501 response is returned when related headers are used.
- DeleteBucketEncryption not supported: Deleting bucket encryption settings is not supported. A 403 response is returned.