Help Center> Object Storage Service> Console Operation Guide> Data Security> Configuring Server-Side Encryption> Uploading an Object in Server-Side Encryption Mode
Updated on 2024-04-15 GMT+08:00
View PDF

Uploading an Object in Server-Side Encryption Mode

OBS allows you to encrypt objects with server-side encryption so that the objects can be securely stored in OBS.

In a bucket with server-side encryption disabled, objects uploaded to it are not encrypted by default, but you can configure server-side encryption for the objects when uploading them. In a bucket with server-side encryption enabled, objects uploaded to it can inherit the encryption settings of the bucket, and you can also separately configure encryption for the objects.

Constraints

  • The object encryption status cannot be changed.
  • A key in use cannot be deleted. Otherwise, the object encrypted with this key cannot be downloaded.
  • If an object is server-side encrypted and does not have any IAM agency, other accounts and users cannot access the object even if they can read this object.

Prerequisites

In the region where OBS is deployed, the KMS Administrator permission has been added to the user group. For details about how to add the permission, see Assigning Permissions to an IAM User. If the current account or user is the grantee, it also requires the KMS Administrator permission.

Procedure

  1. In the navigation pane of OBS Console, choose Object Storage.
  2. In the bucket list, click the bucket you want to operate to go to the Objects page.
  3. Click Upload Object. The Upload Object dialog box is displayed.
  4. Add the files to be uploaded.
  5. Select KMS encryption and select a key that you have created on DEW.

    If the default encryption has been enabled for the bucket, the objects you uploaded will automatically inherit the bucket's KMS encryption settings.

    After KMS encryption is selected, obs/default is selected by default as the key for the encryption. You can also click Create KMS Key to switch to the KMS management console and create a customer master key. Then go back to OBS Console and select the key from the drop-down list.

    For details, see Creating a Key.

    Figure 1 Encrypting an object to be uploaded

  6. Click Upload.

    After the object is uploaded, you can view its encryption status on its details page.