6a186df4a4
Adding replication overview and site replication overview docs. Distinguising between bucket replication and site replication. Adds mc admin replicate docs. Including tutorials for how to do site replication.
2.8 KiB
Data and Network Encryption
minio
Table of Contents
MinIO supports end-to-end encryption of objects over-the-wire (network encryption) and on read/write (at-rest).
Server-Side Object Encryption (SSE)
MinIO supports Server-Side Object Encryption (SSE) <minio-sse>
of objects, where MinIO uses a secret key to encrypt and store objects
on disk (encryption at-rest).
SSE-KMS (Recommended)
MinIO supports enabling automatic SSE-KMS encryption of all objects
written to a bucket using a specific External Key (EK) stored on the
external KMS (Key Management System). Clients can override the
bucket-default EK (External Key) by specifying an explicit key as
part of the write operation.
For buckets without automatic SSE-KMS encryption, clients can specify
an EK (External Key)
as part of the write operation instead.
SSE-KMS provides more granular and customizable encryption compared to SSE-S3 and SSE-C and is recommended over the other supported encryption methods.
SSE-S3
MinIO supports enabling automatic SSE-S3 encryption of all objects
written to a bucket using an EK (External Key) stored on the external KMS (Key Management System).
MinIO SSE-S3 supports one EK (External Key) for the entire deployment.
For buckets without automatic SSE-S3 encryption, clients can request SSE encryption as part of the write operation instead.
SSE-C
Clients specify an EK (External Key) as part of the write operation for
an object. MinIO uses the specified EK (External Key) to perform SSE-S3.
SSE-C does not support bucket-default encryption settings and requires clients perform all key management operations.
MinIO SSE requires minio-tls.
Network Encryption
MinIO supports Transport Layer Security (TLS) <minio-tls>
encryption of incoming and outgoing traffic. MinIO recommends all MinIO
servers run with TLS enabled to ensure end-to-end security of
client-server or server-server transmissions.
TLS is the successor to Secure Socket Layer (SSL) encryption. SSL is fully deprecated as of June 30th, 2018. MinIO uses only supported (non-deprecated) TLS protocols (TLS 1.2 and later).
See minio-tls for
more complete documentation.
/security/server-side-encryption/minio-server-side-encryption.rst /security/network-encryption/minio-tls.rst