minio/docs
1
0
Fork 0
mirror of https://github.com/minio/docs.git synced 2025-04-22 19:02:57 +03:00
Code
docs/source/reference/minio-mc/mc-encrypt-set.rst

4.2 KiB
Raw Blame History

mc encrypt set

minio

Table of Contents

mc encrypt set

Syntax

The mc encrypt set encrypt command sets or updates the default bucket Server-Side Encryption (SSE) mode <minio-sse>. MinIO automatically encrypts objects written to that bucket using the specified SSE mode.

mc encrypt set only supports SSE-KMS <minio-encryption-sse-kms> and SSE-S3 <minio-encryption-sse-s3>.

EXAMPLE

The following command sets the default SSE-KMS encryption key <minio-encryption-sse-kms> for the bucket mydata on the myminio MinIO deployment:

mc encrypt set sse-kms "minio-encryption-key" myminio/mydata

SYNTAX

The command has the following syntax:

mc [GLOBALFLAGS] encrypt set  ENCRYPTION [KMSKEY] ALIAS

Parameters

ENCRYPTION

Specify the server-side encryption type to use as the default SSE mode. Supports the following values:

  • sse-kms - Encrypt objects using the key specified in ~mc encrypt set KMSKEY. MinIO must have access to the specified key on the external KMS to successfully encrypt or decrypt objects protected using SSE-KMS.
  • sse-s3 - Encrypt objects using the key specified to MINIO_KMS_KES_KEY_NAME. MinIO must have access to the specified key on the external KMS to successfully encrypt or decrypt objects protected using SSE-S3.

KMSKEY

Specify the KMS Master Key to use for performing SSE object encryption. This option only applies if ~mc encrypt set ENCRYPTION is sse-kms.

Omit this option to direct MinIO to use the MINIO_KMS_KES_KEY_NAME.

ALIAS

The full path to the bucket on which to set the default SSE mode. Specify the alias <alias> of the MinIO deployment as the prefix to the TARGET path. For example:

mc encrypt set ENCRYPTION [KMSKEY] play/mybucket

Global Flags

Examples

Enable Automatic Server-Side Bucket Encryption

Example

The following commands assumes that:

  • The MinIO server configuration supports SSE-KMS <minio-encryption-sse-kms>
  • The root has an encryption key minio-encryption-key.
mc encrypt set sse-kms minio-encryption-key myminio/data

Syntax

mc encrypt set ENCRYPTION KMSKEY TARGET
  • Replace ENCRYPTION with sse-kms or sse-s3 depending on the preferred encryption mode.
  • Replace KMSKEY with the name of the encryption key on the configured root KMS. This argument has no effect with sse-s3.
  • Replace TARGET with the alias <alias> of the MinIO deployment on which to configure automatic server-side bucket encryption.

Behavior

mc encrypt set makes no assumptions about the MinIO server's current encryption state. Specifying default encryption settings which the server cannot support may result in undesired behavior.

Setting or modifying the default server-side encryption settings does not automatically encrypt or decrypt the existing bucket contents. If the bucket contents must have consistent encryption, use the mc mv mc with the ~mc mv --encrypt or ~mc mv --encrypt-key arguments to manually modify the encryption settings or encrypted state of the bucket contents before changing the bucket default.