Tenant Cloud Storage Cloud Object Storage Developer Guide

Server-Side Encryption Overview

Last Updated At: 2025-11-26 15:44:37

Overview

COS encrypts your data at the object level before the data is written to the disks in the Internet Data Center (IDC) and automatically decrypts the data when you access it. Encryption and decryption are completed on servers. This server-side encryption feature can effectively protect static data.

Note:

  • There is no difference in experience between accessing an encrypted object and accessing an unencrypted object, provided that you have access to the objects.
  • Server-side encryption encrypts only the object data but not its metadata. Server-side encrypted objects can only be accessed with a valid signature and cannot be accessed by anonymous users.
  • Objects encrypted with SSE-KMS cannot be accessed by anonymous users.

Applicable Scenario

  • Private data storage: For private data storage, server-side encryption can encrypt stored data to protect your privacy and automatically decrypt the data when you access it.
  • Private data transfer: For private data transfer, COS supports deploying SSL certificates with HTTPS to implement encryption. An encryption layer will be established on the transfer linkage layer, ensuring that data will not be stolen or tampered with during transfer.

Encryption Methods

COS supports multiple server-side encryption methods such as SSE-COS, SSE-KMS and SSE-C. You can choose a suitable one to encrypt your data stored in COS.

SSE-COS Encryption

SSE-COS encryption is server-side encryption with a key managed by COS. In this mode, COS manages the primary key and the data, and you can manage and encrypt your data directly through COS. SSE-COS adopts strong multi-factor encryption, ensuring that each object is encrypted with a unique key. At the same time, it adopts the Advanced Encryption Standard with a 256-bit key (AES-256) for data encryption, and regularly rotates the primary key to encrypt the key itself.

Note:

  • When uploading an object using the POST operation, you need to provide the same information in the form field instead of the x-cos-server-side-encryption header.
  • If you upload an object with a pre-signed URL, you cannot use SSE-COS encryption to encrypt it. You can only use the COS console or HTTP request header to specify server-side encryption.

Using the COS Console

For details on how to perform SSE-COS encryption on objects via the console, see the document Setting Object Encryption.

Using the REST API

Note:

  • When you list objects in a bucket, all objects will be listed, regardless of whether they are encrypted.
  • When uploading an object using the POST operation, provide the same information in the form field instead of providing the request header.

When you request the following APIs, you can apply server-side encryption by providing the x-cos-server-side-encryption header.

  • PUT Object
  • Initiate Multipart Upload
  • PUT Object - Copy
  • POST Object

SSE-KMS Encryption

SSE-KMS encryption is server-side encryption with a key managed by KMS. KMS is a security management service launched by Converge Cloud and uses a third-party-certified Hardware Security Module (HSM) to generate and protect keys. KMS allows you to easily create and manage keys, meeting your key management needs for multiple applications and services, while satisfying regulatory and compliance requirements.

When using SSE-KMS encryption for the first time, you need to enable the KMS service. After the KMS service is enabled, the system will automatically create a default customer master key (CMK) for you. You can also create your own keys in the KMS console, and define key policies and use methods. KMS allows you to choose your own key material from KMS or External sources.

Note:

  • SSE-KMS only encrypts the object data, not its metadata.
  • Using SSE-KMS encryption will incur an additional cost, which will be charged by KMS.
  • Objects encrypted with SSE-KMS can only be accessed with a valid signature but not by anonymous users.

Using the COS Console

For details on how to perform SSE-KMS encryption on objects via the console, see the document Setting Object Encryption.

Using the REST API

Note:

  • When you list objects in a bucket, all objects will be listed, regardless of whether they are encrypted.
  • When uploading an object using the POST operation, provide the same information in the form field instead of providing the request header.

When you request the following APIs, you can apply server-side encryption by providing the x-cos-server-side-encryption header.

  • PUT Object
  • Initiate Multipart Upload
  • PUT Object - Copy
  • POST Object

Notes

If you have never used COS Console for SSE-KMS encryption and only used API for SSE-KMS encryption, you need to create a CAM Role first. The specific steps are shown below:

  1. Log in to the CAM console and go to the role management list page.
  2. Click Create Role, enter the corresponding parameters as prompted on the interface, and then click Next: Configure role policy.
  3. Configure the role policy, search for and check KMSAccessForCOSRole, and click Next: Review.
  4. Click Complete to complete the process.

SSE-C Encryption

SSE-C encryption is server-side encryption with a user-defined key, so you need to provide the encryption key. When you upload an object, COS will use the encryption key you provide to apply AES-256 encryption to your data.

Note:

  • COS does not store your encryption key. Instead, it stores the HMAC value of the encryption key with random data added. This value is used to verify your request to access the object. COS cannot use the HMAC value with random data to derive the value of the encryption key or to decrypt the encrypted object. Therefore, if you lose the encryption key, you cannot get the object again.
  • When you use the POST operation to upload an object, instead of providing the x-cos-server-side-encryption-* header, you need to provide the same information in the form field.
  • You can only use SSE-C with APIs but not console operations.

Using the REST API

When you request the following APIs, in terms of PUT and POST requests, you can provide the x-cos-server-side-encryption-* header to apply server-side encryption; in terms of GET and HEAD requests for the use of an SSE-C encrypted object, you need to provide the x-cos-server-side-encryption-* header to decrypt the specified object. For more information, see Common Request Headers - SSE-C. This header is supported by the following operations:

  • GET Object
  • HEAD Object
  • PUT Object
  • Initiate Multipart Upload
  • Upload Part
  • POST Object
  • PUT Object - Copy