Configuring Bucket Default Encryption

OBS enables you to configure default encryption for a bucket. After the configuration, objects uploaded to the bucket are automatically encrypted using the specified KMS key, improving data storage security.

You can enable default encryption when creating a bucket (see Creating a Bucket), or enable or disable default encryption after a bucket is created.

OBS encrypts only the objects uploaded after the default encryption is enabled, and does not encrypt those uploaded before. After default encryption is disabled, the encryption status of existing objects keeps unchanged, and you can still manually encrypt objects upon upload.

Enabling Default Encryption for a Bucket

In the navigation pane of OBS Console, choose Object Storage.
In the bucket list, click the bucket name you want. The Objects page is displayed.
In the navigation pane, choose Overview.
In the right Basic Configurations area, click Default Encryption. The Default Encryption dialog box is displayed.
Choose SSE-KMS.
You can select the default key to encrypt the objects you upload to the bucket. If you do not have a default key, OBS automatically creates one the first time you upload an object. You can also choose a custom key for encryption. If no such key is available, click Create KMS Key to create one on the KMS console.

Figure 1 Enabling KMS-based encryption for a bucket
Click OK.

Disabling Default Encryption for a Bucket

In the navigation pane of OBS Console, choose Object Storage.
In the bucket list, click the bucket name you want. The Objects page is displayed.
In the navigation pane, choose Overview.
In the right Basic Configurations area, click Default Encryption. The Default Encryption dialog box is displayed.
Select Disable.
Click OK.