Example of Encryption

If you have any questions during development, post them on the Issues page of GitHub. For details about parameters and usage of each API, see the API Reference.

// Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables ACCESS_KEY_ID and SECRET_ACCESS_KEY_ID.
// Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
String ak = System.getenv("ACCESS_KEY_ID");
String sk = System.getenv("SECRET_ACCESS_KEY_ID");
String endPoint = "https://your-endpoint";
// Create an ObsClient instance.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

PutObjectRequest request = new PutObjectRequest();
request.setBucketName("bucketname");
request.setObjectKey("objectname");
request.setFile(new File("localfile"));
// Set the SSE-C encryption algorithm.
SseCHeader sseCHeader = new SseCHeader();
sseCHeader.setAlgorithm(ServerAlgorithm.AES256);
// Set the key used to encrypt and decrypt objects in SSE-C mode. This value is a Base64-encoded key.
sseCHeader.setSseCKeyBase64("your base64 sse-c key generated by AES-256 algorithm");

request.setSseCHeader(sseCHeader);
obsClient.putObject(request);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

// Enter the endpoint corresponding to the bucket. CN-Hong Kong is used here as an example. Replace it with the one currently in use.
String endPoint = "https://obs.ap-southeast-1.myhuaweicloud.com";
// Hard-coded or plaintext access keys (AK/SK) are risky. For security purposes, encrypt your access keys and store them in the configuration file or environment variables. In this example, access keys are stored in the environment variables for identity authentication. Before running the code in this example, configure environment variables ACCESS_KEY_ID and SECRET_ACCESS_KEY_ID.
// Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
String ak = System.getenv("ACCESS_KEY_ID");
String sk = System.getenv("SECRET_ACCESS_KEY_ID");
// Create an ObsClient instance.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);
// Specify the bucket name, object name, and local file path.
PutObjectRequest request = new PutObjectRequest();
request.setBucketName("BucketName");
request.setObjectKey("ObjectKey");
request.setFile(new File("LocalFilePath"));
// Add a user-defined header to use SSE-OBS.
HashMap<String, String> userHeaders = new HashMap<>();
userHeaders.put("x-obs-server-side-encryption","AES256");
request.setUserHeaders(userHeaders);
HeaderResponse response = obsClient.putObject(request);

// Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables ACCESS_KEY_ID and SECRET_ACCESS_KEY_ID.
// Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
String ak = System.getenv("ACCESS_KEY_ID");
String sk = System.getenv("SECRET_ACCESS_KEY_ID");
String endPoint = "https://your-endpoint";
// Create an ObsClient instance.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

GetObjectRequest request = new GetObjectRequest("bucketname", "objectname");
// Set the decryption algorithm to SSE-C.
SseCHeader sseCHeader = new SseCHeader();
sseCHeader.setAlgorithm(ServerAlgorithm.AES256);
// The key used here must be the one used for uploading the object.
sseCHeader.setSseCKeyBase64("your base64 sse-c key generated by AES-256 algorithm");

request.setSseCHeader(sseCHeader);
ObsObject obsObject = obsClient.getObject(request);

obsObject.getObjectContent().close();

When you download an object encrypted with SSE-OBS or obtain the metadata of such an object, the object is automatically decrypted and no encryption-related headers are required. For details, see Performing a Streaming Download and Obtaining Object Properties.