SSE-KMS

Context

Before using SSE-KMS, you may want to know:

• Data Encryption Workshop (DEW): It is a secure, reliable, and easy-to-use key hosting service provided by Huawei Cloud. You can use DEW to create and manage your keys. These keys can be used for OBS server-side encryption. For more information, see KMS Functions.
• Customer Master Key (CMK): CMKs are top-level keys in DEW. They are used to create and manage other keys (including session keys and data encryption keys). CMKs fall into custom keys and default keys. You can use either of them for SSE-KMS. If you do not specify a key, OBS creates a default key for your account the first time you use SSE-KMS. For more information, see KMS Basic Concepts, How Are Default Keys Generated? What Are the Differences Between a Custom Key and a Default Key? and Creating a Custom Key.
• Data Encrypt Key (DEK): DEKs are used to directly encrypt data.
• Envelope encryption: Instead of encrypting and decrypting data directly with a CMK, envelope encryption uses the CMK to generate a DEK to encrypt and decrypt data, and uses the CMK to encrypt and decrypt the DEK. For more information, see What Are the Benefits of Envelope Encryption?

Billing

You will be billed for using KMS keys. For details, see KMS Billing Items.

Important Notes

• Data Encryption Workshop (DEW) APIs have traffic control limits (see DEW API Overview). After SSE-KMS is enabled, your service access may be affected by traffic control.
• The ETag value of an encrypted object is the MD5 value of the ciphertext, rather than that of the plaintext.

Constraints

• SSE-KMS supports the AES-256 and SM4 algorithms.
• HTTPS is required for requests that configure SSE-KMS for buckets, as well as for all GET and PUT requests that use SSE-KMS.
• Anonymous users cannot access objects encrypted using SSE-KMS. Any request for accessing such an object must be signed using valid credentials (either permanent access keys or temporary security credentials). For more information about signing, see Authentication Overview.
• To use a custom customer master key (CMK), the bucket with SSE-KMS enabled must be in the same region as the CMK. The default key is not region-specific or IAM user-specific. All account IDs under a single Huawei account share the same default key in all regions.
• Custom CMKs only support the AES-256 and SM4 algorithms.
• For cross-account access, use custom keys for SSE-KMS.

How SSE-KMS Works

Figure 1 SSE-KMS encryption process

Figure 1 shows how SSE-KMS encryption works with envelope encryption:

1. DEW derives a DEK from a CMK, uses the CMK to encrypt the DEK, and sends both the plaintext and ciphertext of the DEK to OBS.
2. OBS uses the plaintext DEK to encrypt data and then promptly deletes the plaintext DEK from memory.
3. OBS stores the ciphertext DEK as metadata along with the ciphertext object.

Figure 2 SSE-KMS decryption process

Figure 2 shows how SSE-KMS decryption works:

1. OBS requests DEW to decrypt the ciphertext DEK.
2. DEW uses the CMK used during encryption to decrypt the DEK and returns the plaintext DEK to OBS.
3. OBS uses the plaintext DEK to decrypt the ciphertext object, obtains the plaintext object, and then promptly deletes the plaintext DEK from memory.

Permissions Configuration

Enforce a specific server-side encryption method for objects uploaded to a bucket:

• You can configure a bucket policy to enforce a specific server-side encryption method for objects uploaded to that bucket. For example, to ensure that objects uploaded to bucket ExampleBucket via PUT are encrypted using SSE-KMS, you can configure a bucket policy that denies any upload requests lacking the x-obs-server-side-encryption:"kms" header:

  1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

  { "Statement": [ { "Sid": "DenyUnEncryptedObjectUploads", "Effect": "Deny", "Principal": "*", "Action": "PutObject", "Resource": "ExampleBucket/*", "Condition": { "StringNotEquals": { "x-obs-server-side-encryption": "kms" } } } ] }

• Authorize an account to access objects encrypted using server-side encryption in another account:
  Assume that Huawei Cloud account A uses its own key k to encrypt object a in bucket A. To access object a, Huawei Cloud account B must be granted the permissions for the bucket, object, as well as the key:

  • Bucket and object authorization: Account A authorizes account B to access the bucket. For details, see Granting Permissions to Other Accounts.
  • Key authorization: Account A authorizes account B to access key k. For details, see Creating a Grant for a Custom Key.

  For cross-account access, use custom keys for SSE-KMS.

Impacts of Server-Side Encryption on Other Operations

Object uploads and downloads

As long as your permissions are properly configured, there is no difference in how you access encrypted and unencrypted objects. For example, if you use a pre-signed URL to share your object, anyone with the shared URL can access your object, regardless of whether it is encrypted. This means that the encryption status does not affect how the URL works. In addition, when you list objects in a bucket, the API returns all objects, regardless of whether they are encrypted.

Prerequisites

If you plan to use a custom CMK, create one before configuring SSE-KMS. For details, see Creating a Custom Key.

Configuring SSE-KMS for a Bucket

You can use OBS Console, APIs, or SDKs to configure SSE-KMS for a bucket.

Configuring SSE-KMS for an Object

You can use OBS Console, APIs, or SDKs to configure SSE-KMS for an object.

Changing the Encryption Status of an Existing Object

By copying an existing object to itself, you can apply encryption or change its encryption method.

You can use APIs and SDKs to change an object's encryption settings.

References

• When you use SSE-KMS to encrypt a large number of objects, OBS sends numerous requests to KMS to derive DEKs. This increases latency and causes high traffic to KMS. To reduce the number of KMS calls, you can use the bucket key that caches DEKs at the bucket level, thereby reducing costs and improving performance. For details, see Using OBS Bucket Keys to Reduce SSE-KMS Costs.