mirror of
https://github.com/minio/docs.git
synced 2025-04-21 08:05:59 +03:00
363e688617
- Adds new environment variable for ILM expiration workers
- Adds new metrics for locks
- Adds keyrotate batch job type
- Adds info about batch replicate from remote to local
Closes #806
Staged:
http://192.241.195.202:9000/staging/minio-2023-04-07/administration/batch-framework.html
93 lines
3.5 KiB
ReStructuredText
93 lines
3.5 KiB
ReStructuredText
.. _minio-sse-data-encryption:
|
|
|
|
=====================
|
|
Data Encryption (SSE)
|
|
=====================
|
|
|
|
.. default-domain:: minio
|
|
|
|
.. contents:: Table of Contents
|
|
:local:
|
|
:depth: 2
|
|
|
|
.. |EK| replace:: :abbr:`EK (External Key)`
|
|
.. |SSE| replace:: :abbr:`SSE (Server-Side Encryption)`
|
|
.. |KMS| replace:: :abbr:`KMS (Key Management System)`
|
|
|
|
MinIO Server-Side Encryption (SSE) protects objects as part of write operations,
|
|
allowing clients to take advantage of server processing power to secure objects
|
|
at the storage layer (encryption-at-rest). SSE also provides key functionality
|
|
to regulatory and compliance requirements around secure locking and erasure.
|
|
|
|
MinIO SSE uses the :minio-git:`MinIO Key Encryption Service (KES) <kes>` and an
|
|
external Key Management Service (KMS) for performing secured cryptographic
|
|
operations at scale. MinIO also supports client-managed key management, where
|
|
the application takes full responsibility for creating and managing encryption
|
|
keys for use with MinIO SSE.
|
|
|
|
MinIO supports the following |KMS| as the central key store:
|
|
|
|
- :ref:`Hashicorp KeyVault <minio-sse-vault>`
|
|
- :ref:`AWS SecretsManager <minio-sse-aws>`
|
|
- :ref:`Google Cloud SecretManager <minio-sse-gcp>`
|
|
- :ref:`Azure Key Vault <minio-sse-azure>`
|
|
- :minio-git:`Fortanix SDKMS <kes/wiki/Fortanix-SDKMS>`
|
|
- :minio-git:`Thales Digital Identity and Security (formerly Gemalto) <kes/wiki/Gemalto-KeySecure>`
|
|
|
|
MinIO SSE requires enabling :ref:`minio-tls`.
|
|
|
|
Supported Encryption Types
|
|
--------------------------
|
|
|
|
MinIO SSE is feature and API compatible with
|
|
:s3-docs:`AWS Server-Side Encryption <server-side-encryption.html>` and
|
|
supports the following encryption strategies:
|
|
|
|
.. tab-set::
|
|
|
|
.. tab-item:: SSE-KMS *Recommended*
|
|
:sync: sse-kms
|
|
|
|
MinIO supports enabling automatic SSE-KMS encryption of all objects
|
|
written to a bucket using a specific External Key (EK) stored on the
|
|
external |KMS|. Clients can override the bucket-default |EK| by specifying
|
|
an explicit key as part of the write operation.
|
|
|
|
For buckets without automatic SSE-KMS encryption, clients can specify
|
|
an |EK| as part of the write operation instead.
|
|
|
|
SSE-KMS provides more granular and customizable encryption compared to
|
|
SSE-S3 and SSE-C and is recommended over the other supported encryption
|
|
methods.
|
|
|
|
For a tutorial on enabling SSE-KMS in a local (non-production) MinIO Deployment, see :ref:`minio-encryption-sse-kms-quickstart`.
|
|
|
|
.. tab-item:: SSE-S3
|
|
:sync: sse-s3
|
|
|
|
MinIO supports enabling automatic SSE-S3 encryption of all objects
|
|
written to a bucket using an |EK| stored on the external |KMS|. MinIO
|
|
SSE-S3 supports *one* |EK| for the entire deployment.
|
|
|
|
For buckets without automatic SSE-S3 encryption, clients can request
|
|
SSE encryption as part of the write operation instead.
|
|
|
|
For a tutorial on enabling SSE-s3 in a local (non-production) MinIO Deployment, see :ref:`minio-encryption-sse-s3-quickstart`.
|
|
|
|
.. tab-item:: SSE-C
|
|
:sync: sse-c
|
|
|
|
Clients specify an |EK| as part of the write operation for an object.
|
|
MinIO uses the specified |EK| to perform SSE-S3.
|
|
|
|
SSE-C does not support bucket-default encryption settings and requires
|
|
clients perform all key management operations.
|
|
|
|
.. toctree::
|
|
:titlesonly:
|
|
:hidden:
|
|
|
|
/operations/server-side-encryption/configure-minio-kes-hashicorp
|
|
/operations/server-side-encryption/configure-minio-kes-aws
|
|
/operations/server-side-encryption/configure-minio-kes-gcp
|
|
/operations/server-side-encryption/configure-minio-kes-azure |