Configuring Bucket Encryption (SDK for C)

Function

If encryption is enabled for a bucket, objects uploaded to it will be encrypted based on the specified encryption method before being stored in OBS. When you download these objects, OBS decrypts them first before returning them to you.

This API is used to configure or update encryption for a bucket.

Restrictions

• To configure encryption for a bucket, you must be the bucket owner or have the required permission (obs:bucket:PutEncryptionConfiguration granted using IAM or PutEncryptionConfiguration granted using a bucket policy). For details, see Introduction to OBS Access Control, IAM Custom Policies, and Creating a Custom Bucket Policy.
• The mapping between OBS regions and endpoints must comply with what is listed in Regions and Endpoints.

Method

void set_bucket_encryption(const obs_options *options,
         obs_server_side_encryption_configuration *encryption_config,
         obs_response_handler *handler, void *callback_data);

Request Parameters

Sample Code

This example configures SSE-OBS for a bucket.

#include "eSDKOBS.h"
#include <stdio.h>
obs_status response_properties_callback(const obs_response_properties *properties, void *callback_data);
void response_complete_callback(obs_status status, const obs_error_details *error, void *callback_data);
int main()
{
    obs_initialize(OBS_INIT_ALL);
    obs_options options;
    init_obs_options(&options);
    // Enter the endpoint corresponding to the bucket for host_name. CN-Hong Kong is used here as an example. Replace it with the one currently in use.
    options.bucket_options.host_name = "obs.ap-southeast-1.myhuaweicloud.com";
    // Hard-coded or plaintext AK and SK are risky. For security purposes, encrypt your AK and SK and store them in the configuration file or environment variables.
    // In this example, the AK and SK are stored in environment variables for identity authentication. Before running the code in this example, configure local environment variables ACCESS_KEY_ID and SECRET_ACCESS_KEY.
    options.bucket_options.access_key = getenv("ACCESS_KEY_ID");
    options.bucket_options.secret_access_key = getenv("SECRET_ACCESS_KEY");
    options.bucket_options.bucket_name = "example-bucket-name";
    // Configure an encryption rule.
    obs_server_side_encryption_rule rule = {0};
    rule.sse_algorithm = "AES256";
    // Set the encryption configuration.
    obs_server_side_encryption_configuration encryption_config = {0};
    encryption_config.rule = &rule;
    obs_response_handler response_handler = {&response_properties_callback, &response_complete_callback};
    obs_status ret_status = OBS_STATUS_BUTT;
    set_bucket_encryption(&options, &encryption_config, &response_handler, &ret_status);
    if (OBS_STATUS_OK == ret_status) {
        printf("set bucket encryption successfully.\n");
    } else {
        printf("set bucket encryption failed(%s).\n", obs_get_status_name(ret_status));
    }
    obs_deinitialize();
}
obs_status response_properties_callback(const obs_response_properties *properties, void *callback_data)
{
    (void)properties; (void)callback_data;
    return OBS_STATUS_OK;
}
void response_complete_callback(obs_status status, const obs_error_details *error, void *callback_data)
{
    if (callback_data) { *(obs_status*)callback_data = status; }
    if (error && error->message) { printf("Error: %s\n", error->message); }
}

Helpful Links

• The API for configuring bucket encryption
• OBS Error Codes
• Security FAQ