docs/source/operations/server-side-encryption/configure-minio-kes.rst

Server-Side Object Encryption with KES

minio

Table of Contents

linux

This procedure provides guidance for deploying MinIO configured to use KES and enable Server Side Encryption <minio-sse-data-encryption>. For instructions on running KES, see the KES docs <tutorials/getting-started/>.

As part of this procedure, you will:

1. Create a new EK (External Key) for use with SSE (Server-Side Encryption).
2. Create or modify a MinIO deployment with support for SSE (Server-Side Encryption) using KES (Key Encryption Service). Defer to the Deploy Distributed MinIO <minio-mnmd> tutorial for guidance on production-ready MinIO deployments.
3. Configure automatic bucket-default SSE-KMS <minio-encryption-sse-kms>

macos or windows

This procedure assumes a single local host machine running the MinIO and KES processes. For instructions on running KES, see the KES docs <tutorials/getting-started/>.

Note

For production orchestrated environments, use the MinIO Kubernetes Operator to deploy a tenant with SSE (Server-Side Encryption) enabled and configured for use with your KMS (Key Management System).

For production baremetal environments, see the MinIO on Linux documentation for tutorials on configuring MinIO with KES and your KMS (Key Management System).

As part of this procedure, you will:

1. Create a new EK (External Key) for use with SSE (Server-Side Encryption).
2. Deploy a MinIO server in Single-Node Single-Drive mode <minio-snsd> configured to use the KES (Key Encryption Service) container for supporting SSE (Server-Side Encryption).
3. Configure automatic bucket-default SSE-KMS <minio-encryption-sse-kms>.

container

This procedure assumes that you use a single host machine to run both the MinIO and KES containers. For instructions on running KES, see the KES docs <tutorials/getting-started/>.

As part of this procedure, you will:

1. Create a new EK (External Key) for use with SSE (Server-Side Encryption).
2. Deploy a MinIO Server container in Single-Node Single-Drive mode <minio-snsd> configured to use the KES (Key Encryption Service) container for supporting SSE (Server-Side Encryption).
3. Configure automatic bucket-default SSE-KMS <minio-encryption-sse-kms>.

For production orchestrated environments, use the MinIO Kubernetes Operator to deploy a tenant with SSE (Server-Side Encryption) enabled and configured for use with your KMS (Key Management System).

For production baremetal environments, see the MinIO on Linux documentation for tutorials on configuring MinIO with KES and your KMS (Key Management System).

k8s

This procedure assumes you have access to a Kubernetes cluster with an active MinIO Operator installation. For instructions on running KES, see the KES docs <tutorials/getting-started/>.

As part of this procedure, you will:

1. Use the MinIO Operator Console to create or manage a MinIO Tenant.
2. Access the Encryption settings for that tenant and configure SSE (Server-Side Encryption) using a supported Key Management System <#supported-kms-targets>.
3. Create a new EK (External Key) for use with SSE (Server-Side Encryption).
4. Configure automatic bucket-default SSE-KMS <minio-encryption-sse-kms>.

For production baremetal environments, see the MinIO on Linux documentation for tutorials on configuring MinIO with KES and your KMS (Key Management System).

Important

Prerequisites

k8s

MinIO Kubernetes Operator and Plugin

See deploy-operator-kubernetes for complete documentation on deploying the MinIO Operator.

Ensure KES Access to a Supported KMS Target

linux or macos or windows or container

This procedure assumes an existing KES installation connected to a supported KMS (Key Management System) installation accessible, both accessible from the local host. Refer to the installation instructions for your supported KMS target <#supported-kms-targets> to deploy KES and connect it to a KMS solution.

KES Operations Require Unsealed Target

Some supported KMS (Key Management System) targets allow you to seal or unseal the vault instance. KES returns an error if the configured KMS (Key Management System) service is sealed.

If you restart or otherwise seal your vault instance, KES cannot perform any cryptographic operations against the vault. You must unseal the Vault to ensure normal operations.

See the documentation for your chosen KMS (Key Management System) solution for more information on whether unsealing may be required.

k8s

Refer to the configuration instruction in the KES documentation <> for your chosen supported KMS (Key Management System):

• AWS Secrets Manager <integrations/aws-secrets-manager/>
• Azure KeyVault <integrations/azure-keyvault/>
• Entrust KeyControl <integrations/entrust-keycontrol/>
• Fortanix SDKMS <integrations/fortanix-sdkms/>
• Google Cloud Secret Manager <ntegrations/google-cloud-secret-manager/>
• Hashicorp Vault <integrations/hashicorp-vault-keystore/>
• Thales CipherTrust Manager (formerly Gemalto KeySecure) <integrations/thales-ciphertrust/>

linux or macos or windows

Deploy or Ensure Access to a MinIO Deployment

container

Install Podman or a Similar Container Management Interface

container

linux

macos

k8s

windows