Configuring Bucket Encryption

Bucket

string

Yes

Explanation:

Bucket name

Restrictions:

• A bucket name must be unique across all accounts and regions.
• A bucket name:
  • Must be 3 to 63 characters long and start with a digit or letter. Lowercase letters, digits, hyphens (-), and periods (.) are allowed.
  • Cannot be formatted as an IP address.
  • Cannot start or end with a hyphen (-) or period (.).
  • Cannot contain two consecutive periods (..), for example, my..bucket.
  • Cannot contain a period (.) and a hyphen (-) adjacent to each other, for example, my-.bucket or my.-bucket.
• If you repeatedly create buckets with the same name in the same region, no error will be reported and the bucket properties comply with those set in the first creation request.

Default value:

None

Rule

object

Yes

Explanation:

Bucket encryption configuration rule. For details, see Table 2.

ApplyServerSideEncryptionByDefault

object

Yes

Explanation:

Default encryption configuration of the bucket. For details, see Table 3.

BucketKeyEnabled

bool

No

Explanation:

Whether to enable the OBS bucket key feature

Restrictions:

• This parameter is available only when SSEAlgorithm is set to kms.
• When configuring a POSIX bucket, set this parameter to true and KMSMasterKeyID is mandatory.

Value range:

• true: The OBS bucket key feature is enabled.
• false: The OBS bucket key feature is disabled.

Default value:

false

SSEAlgorithm

String

Yes

Explanation:

Server-side encryption algorithm used for the default encryption configuration of a bucket

Restrictions:

N/A

Value range:

• kms: SSE-KMS encryption and the AES256 algorithm are used. To use the SM4 algorithm, you need to configure KMSDataEncryption.
• AES256: SSE-OBS encryption and the AES256 algorithm are used.

Default value:

N/A

KMSDataEncryption

String

No

Explanation:

Encryption algorithm used in SSE-KMS mode

Restrictions:

N/A

Value range:

SM4: SM4 algorithm

Default value:

N/A

KMSMasterKeyID

String

No

Explanation:

ID of the KMS master key used in SSE-KMS mode

Restrictions:

• If this parameter is not specified, the default master key will be used.
• If BucketKeyEnabled is set to true, the value of KMSMasterKeyID is the ID of the master key created on KMS.

Value range:

• regionID:domainID:key/key_id
• key_id

In the preceding formats:

• regionID indicates the ID of the region where the key is used. You can obtain it from Regions and Endpoints.
• domainID indicates the ID of the account to which the key belongs. To obtain it, see How Do I Get My Account ID and User ID?.
• key_id indicates the ID of the key created on Data Encryption Workshop (DEW). To obtain it, see Viewing a CMK.

Default value:

N/A

ProjectID

String

No

Explanation:

ID of the project where the KMS master key belongs in SSE-KMS mode

Restrictions:

• If the project is not the default one, you must use this parameter to specify the project ID.
• Leave the project ID blank if KMSMasterKeyID is not specified.
• If a custom key in a non-default IAM project is used to encrypt objects, only the key owner can upload or download the encrypted objects.

Value range:

Project ID that matches KMSMasterKeyID, that is, the ID of the project to which the master key with the specified KMSMasterKeyID belongs

Default value:

N/A

Parameter

Type

Description

Status

number

Explanation:

HTTP status code returned by the OBS server

Value range:

A status code is a group of digits indicating the status of a response. It ranges from 2xx (indicating successes) to 4xx or 5xx (indicating errors). For details, see Status Codes.

Code

string

Explanation:

Error code returned by the OBS server

Message

string

Explanation:

Error description returned by the OBS server

HostId

string

Explanation:

Request server ID returned by the OBS server

RequestId

string

Explanation:

Request ID returned by the OBS server

Id2

string

Explanation:

Request ID2 returned by the OBS server

Indicator

string

Explanation:

Error code details returned by the OBS server