Server-side encryption

You can use SSE-OSS to encrypt each object. To improve security, OSS uses master keys to encrypt data keys that are rotated on a regular basis. You can use this method to encrypt and decrypt multiple objects at a time.

In this method, OSS generates different keys to encrypt different objects by using the default CMK stored in KMS, and automatically decrypts an object when the object is downloaded. OSS creates a CMK on the KMS platform when you use SSE-OSS for the first time.

You can use the following configuration methods:

• Configure the default server-side encryption method for a bucket

  Set the default server-side encryption method for a bucket to KMS,but do not specify a CMK ID. Objects uploaded to this bucket are encrypted.

• Configure an encryption method for a specified object

  When you upload an object or modify the metadata of an object, the x-oss-server-side-encryption parameter is included in the request and the parameter value is set to KMS. In this case, OSS uses the default CMK stored in KMS and uses the AES-256 encryption algorithm to encrypt the object.For more information, see PutObject.

After you use the BYOK material in the KMS console to generate a CMK, the keys generated by a specified CMK stored in KMS are used to encrypt different objects and the specified CMK ID is recorded in the metadata of the encrypted object. Objects are decrypted only when they are downloaded by users who have the permissions to decrypt the objects.

• The permissions to manage the bucket.
• The permissions to perform the PutBucketEncryption and GetBucketEncryption operations.
• The permissions to perform the ListKeys, Listalias, ListAliasesByKeyId, and DescribeKeys operations when you set the encryption method to SSE-KMS and use a specified CMK ID to encrypt data. The following RAM policy provides an example on how to specify the permissions associated with CMK IDs:

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "kms:List*",
          "kms:DescribeKey"    
        ],
        "Resource": [
          "acs:kms:*:1416614965936597:*" // In this example, the user is allowed to use all CMKs that belong to the account. To specify that only a CMK is available, enter the CMK ID.
        ]
      }
    ]
  }

• The permissions to upload objects to the bucket.
• The permissions to perform the ListKeys, Listalias, ListAliasesByKeyId, DescribeKeys, and GenerateDataKey operations when you set the encryption method to KMS and use a specified CMK ID to encrypt data. The following RAM policy provides an example on how to specify the permissions associated with CMK IDs:

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "kms:List*",
          "kms:DescribeKey",
          "kms:GenerateDataKey"
        ],
        "Resource": [
          "acs:kms:*:1416614965936597:*" // In this example, the user is allowed to use all CMKs that belong to the account. To specify that only a CMK is available, enter the CMK ID.
        ]
      }
    ]
  }

• The permissions to access objects in the bucket.
• The permissions to perform the Decrypt operation when you set the encryption method to KMS and use a specified CMK ID to encrypt data. The following RAM policy provides an example on how to specify the permissions associated with CMK IDs:

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
      "kms:Decrypt"
        ],
        "Resource": [
          "acs:kms:*:1416614965936597:*" // In this example, the RAM user has the permissions to decrypt data by using all CMKs. To decrypt data by using a specified CMK, enter the CMK ID.
        ]
      }
    ]
  }