How to manage the server-side encryption configurations of a bucket by running the bucket-encryption command - Object Storage Service

After you configure server-side encryption (bucket encryption), Object Storage Service (OSS) encrypts uploaded objects and permanently stores the encrypted objects. When you download objects, OSS decrypts the objects and returns the decrypted objects. This topic describes how to run the bucket-encryption command to add, modify, query, or delete the server-side encryption configurations of a bucket.

Usage notes

To add or modify the server-side encryption configurations of a bucket, you must have the oss:PutBucketEncryption permission. To query the server-side encryption configurations of a bucket, you must have the oss:GetBucketEncryption permission. To delete the server-side encryption configurations of a bucket, you must have the oss:DeleteBucketEncryption permission. For more information, see Grant a custom policy.

For ossutil 1.6.16 and later, you can directly use ossutil as the binary name in the command line. You do not need to update the binary name based on the operating system. For ossutil earlier than 1.6.16, you need to update the binary name based on the operating system. For more information, see ossutil command reference.
For more information about server-side encryption, see Server-side encryption.

Add or modify the server-side encryption configurations of a bucket

Command syntax

ossutil bucket-encryption --method put oss://bucketName --sse-algorithm algorithmName
[--kms-masterkey-id keyid]

The following table describes the preceding parameters.

Parameter	Description
bucketName	The name of the bucket for which you want to configure server-side encryption.
--sse-algorithm	The encryption method of the bucket. Valid values: KMS: The keys managed by Key Management Service (KMS) are used for encryption and decryption (SSE-KMS). AES256: The keys managed by OSS are used for encryption and decryption (SSE-OSS).
--kms-masterkey-id	The ID of the KMS-managed customer master key (CMK) used to encrypt objects when the encryption method is set to SSE-KMS. If you do not specify this parameter, the default CMK is used to encrypt objects. If you want to use a specific CMK, use this parameter to configure the CMK ID. Note If you use OSS on CloudBox, this parameter is not supported.

Examples
- Run the following command to set the encryption method to SSE-OSS and the encryption algorithm to AES256 for examplebucket:
```
ossutil bucket-encryption --method put oss://examplebucket --sse-algorithm AES256
```
- Run the following command to set the encryption method to SSE-KMS, specify a CMK ID, and use the default encryption algorithm AES256 for examplebucket:
```
ossutil bucket-encryption --method put oss://examplebucket --sse-algorithm KMS --kms-masterkey-id 9468da86-3509-4f8d-a61e-6eab1eac****
```
- If the following output is displayed, server-side encryption is configured for examplebucket:
```
0.856895(s) elapsed
```
To verify that the configurations take effect, query the server-side encryption configurations of examplebucket.

Query the server-side encryption configurations of a bucket

Command syntax

ossutil bucket-encryption --method get oss://bucketName

Examples

Run the following command to query the server-side encryption configurations of examplebucket:
```
ossutil bucket-encryption --method get oss://examplebucket
```
If the following output is displayed, the server-side encryption method configured for examplebucket is SSE-KMS, the CMK ID is not specified, and the default encryption algorithm AES256 is used:
```
SSEAlgorithm:KMS
KMSMasterKeyID:
KMSDataEncryption:
```

Delete the server-side encryption configurations of a bucket

Command syntax

ossutil bucket-encryption --method delete oss://bucketName

Examples

Run the following command to delete the server-side encryption configurations of examplebucket:
```
ossutil bucket-encryption --method delete oss://examplebucket
```
If the following output is displayed, the server-side encryption configurations of examplebucket are deleted:
```
0.856686(s) elapsed
```

Common options

To access a bucket in a different region, use -e to specify the endpoint. To access a bucket owned by a different Alibaba Cloud account, use -i for the AccessKey ID and -k for the AccessKey secret.

For example, you can run the following command to set the encryption method to AES256 for a bucket named examplebucket, which is located in the China (Hangzhou) region and is owned by another Alibaba Cloud account:

ossutil bucket-encryption --method put oss://examplebucket --sse-algorithm AES256 -e oss-cn-hangzhou.aliyuncs.com -i yourAccessKeyID -k yourAccessKeySecret

For a complete list of common options, see the following topic.

Common options.