mc encrypt set — MinIO Object Storage for Linux (original) (raw)

Table of Contents

• Syntax
  • Parameters
  • Global Flags
• Examples
  • Enable Automatic Server-Side Bucket Encryption
• Behavior

Syntax

The mc encrypt set encrypt command sets or updates the default bucket Server-Side Encryption (SSE) mode. MinIO automatically encrypts objects written to that bucket using the specified SSE mode.

mc encrypt set only supports SSE-KMSand SSE-S3.

EXAMPLE

The following command sets the defaultSSE-KMS encryption key for the bucketmydata on the myminio MinIO deployment:

mc encrypt set sse-kms "minio-encryption-key" myminio/mydata

SYNTAX

The command has the following syntax:

mc [GLOBALFLAGS] encrypt set ENCRYPTION [KMSKEY] ALIAS

• Brackets [] indicate optional parameters.
• Parameters sharing a line are mutually dependent.
• Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Parameters

ENCRYPTION

Specify the server-side encryption type to use as the default SSE mode. Supports the following values:

• sse-kms - Encrypt objects using the key specified inKMSKEY. MinIO must have access to the specified key on the external KMS to successfully encrypt or decrypt objects protected using SSE-KMS.
• sse-s3 - Encrypt objects using the key specified toMINIO_KMS_KES_KEY_NAME. MinIO must have access to the specified key on the external KMS to successfully encrypt or decrypt objects protected using SSE-S3.

KMSKEY

Specify the KMS Master Key to use for performing SSE object encryption. This option only applies if ENCRYPTION issse-kms.

Omit this option to direct MinIO to use theMINIO_KMS_KES_KEY_NAME.

ALIAS

The full path to the bucket on which to set the default SSE mode. Specify thealias of the MinIO deployment as the prefix to the TARGET path. For example:

mc encrypt set ENCRYPTION [KMSKEY] play/mybucket

Global Flags

This command supports any of the global flags.

Examples

Enable Automatic Server-Side Bucket Encryption

Example

The following commands assumes that:

• The MinIO server configuration supportsSSE-KMS
• The root has an encryption key minio-encryption-key.

mc encrypt set sse-kms minio-encryption-key myminio/data

Syntax

mc encrypt set ENCRYPTION KMSKEY TARGET

• Replace ENCRYPTION with sse-kms or sse-s3 depending on the preferred encryption mode.
• Replace KMSKEY with the name of the encryption key on the configured root KMS. This argument has no effect with sse-s3.
• Replace TARGET with the alias of the MinIO deployment on which to configure automatic server-side bucket encryption.

Behavior

mc encrypt set makes no assumptions about the MinIO server’s current encryption state. Specifying default encryption settings which the server cannot support may result in undesired behavior.

Setting or modifying the default server-side encryption settings does _not_automatically encrypt or decrypt the existing bucket contents. If the bucket contents must have consistent encryption, use themc mv command with --enc-kms, --enc-s3, or --enc-c to specify the type of encryption to use for the moved contents. This manually modifies the encryption settings or encrypted state of the bucket contents before changing the bucket default.