SSE-KMS

Context

Before using SSE-KMS, you may want to know:

• Key Management Service (KMS): It is a secure, reliable, and easy-to-use key hosting service provided by Huawei Cloud. You can use KMS to create and manage keys. The created keys can be used for server-side encryption. For more information, see KMS Overview.
• Customer Master Key (CMK): CMKs are top-level keys in KMS. They are used to create and manage other keys (including session keys and data encryption keys). CMKs fall into custom keys and default keys. You can use either of them for SSE-KMS. If you do not specify a key, OBS creates a default key for your account the first time you use SSE-KMS. For more information, see KMS Basic Concepts, How Are Default Keys Generated? What Are the Differences Between a Custom Key and a Default Key? and Creating a Custom Key.
• Data Encryption Key (DEK): DEKs are used to encrypt data. For more information, see How Do I Use a DEK?
• Envelope encryption: Instead of encrypting and decrypting data directly with a CMK, envelope encryption uses the CMK to generate a DEK to encrypt and decrypt data, and uses the CMK to encrypt and decrypt the DEK. For more information, see What Are the Benefits of Envelope Encryption?

Billing

You will be billed for using KMS keys. For details, see KMS Billing Items.

Important Notes

• DEW APIs have traffic control limits (see DEW API Overview). After SSE-KMS is enabled, your service access may be affected by traffic control.
• The ETag value of an encrypted object is the MD5 value of the ciphertext, rather than that of the plaintext.

Constraints

• SSE-KMS supports the AES-256 and SM4 algorithms.
• HTTPS is required for requests that configure SSE-KMS for buckets, as well as for all GET and PUT requests that use SSE-KMS.
• To access objects encrypted using SSE-KMS, anonymous users must use valid credentials (permanent or temporary access keys) to sign requests. For details, see OBS Signatures.
• To use a custom customer master key (CMK), the bucket with SSE-KMS enabled must be in the same region as the CMK. The default key is not region-specific or IAM user-specific. All IAM users under a HUAWEI ID share the same default key in all regions.
• Custom CMKs only support the AES-256 and SM4 algorithms.
• For cross-account access, use custom keys for SSE-KMS.

How SSE-KMS Works

Figure 1 SSE-KMS encryption process

Figure 1 shows how SSE-KMS encryption works with envelope encryption:

1. KMS derives a DEK from a CMK, uses the CMK to encrypt the DEK, and sends both the plaintext and ciphertext of the DEK to OBS.
2. OBS uses the plaintext DEK to encrypt data and then promptly deletes the plaintext DEK from memory.
3. OBS stores the ciphertext DEK as metadata along with the ciphertext object.

Figure 2 SSE-KMS decryption process

Figure 2 shows how SSE-KMS decryption works:

1. OBS requests KMS to decrypt the ciphertext DEK.
2. KMS uses the CMK used during encryption to decrypt the DEK and returns the DEK plaintext to OBS.
3. OBS uses the plaintext DEK to decrypt the ciphertext object, obtains the plaintext object, and then promptly deletes the plaintext DEK from memory.

Permissions Configuration

Enforce a specific server-side encryption method for objects uploaded to a bucket:

• You can configure a bucket policy to enforce a specific server-side encryption method for objects uploaded to that bucket. For example, to ensure that objects uploaded to bucket ExampleBucket via PUT are encrypted using SSE-KMS, you can configure a bucket policy that denies any upload requests lacking the x-obs-server-side-encryption:"kms" header:

  1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

  { "Statement": [ { "Sid": "DenyUnEncryptedObjectUploads", "Effect": "Deny", "Principal": "*", "Action": "PutObject", "Resource": "ExampleBucket/*", "Condition": { "StringNotEquals": { "x-obs-server-side-encryption": "kms" } } } ] }

• Authorize an account to access objects encrypted using server-side encryption in another account:
  Assume that HUAWEI ID A uses its own key k to encrypt object a in bucket A. To access object a, HUAWEI ID B needs to be granted the permissions for the bucket, object, as well as the key:

  • Bucket and object authorization: ID A authorizes ID B to access the bucket. For details, see Granting Permissions to Other Accounts.
  • Key authorization: ID A authorizes ID B to access key k. For details, see Creating a Grant for a Custom Key.

  For cross-account access, use custom keys for SSE-KMS.

Impacts of Server-Side Encryption on Other Operations

Object uploads and downloads

As long as your permissions are properly configured, there is no difference in how you access encrypted and unencrypted objects. For example, if you use a pre-signed URL to share your object, anyone with the shared URL can access your object, regardless of whether it is encrypted. This means that the encryption status does not affect how the URL works. In addition, when you list objects in a bucket, the API returns all objects, regardless of whether they are encrypted.

Prerequisites

If you plan to use a custom CMK, create one before configuring SSE-KMS. For details, see Creating a Custom Key.

Configuring SSE-KMS for a Bucket

You can use OBS Console, APIs, or SDKs to configure SSE-KMS for a bucket.

Configuring SSE-KMS for an Object

You can use OBS Console, APIs, or SDKs to configure SSE-KMS for an object.

Changing the Encryption Status of an Existing Object

By copying an existing object to itself, you can apply encryption or change its encryption method.

You can use APIs and SDKs to change an object's encryption settings.