Overview
Bucket encryption is a configuration for a bucket. By setting bucket encryption, you can encrypt all new objects uploaded to a bucket with the specified encryption method by default.
Currently the following encryption methods are supported:
- SSE-COS encryption: Server-side encryption with a key managed by COS.
- SSE-KMS encryption: Server-side encryption with a key managed by KMS.
Usage Instructions
Using the COS Console
You can use the COS console to set bucket encryption.
Using the REST API
You can configure bucket encryption by using the following APIs:
- PUT Bucket encryption
- GET Bucket encryption
- DELETE Bucket encryption
Notes
Uploading object to encrypted bucket
For buckets requiring encryption, note the following:
- Configuring encryption for a bucket will not lead to encryption operations on objects that already exist in it.
- After encryption is configured for a bucket, for objects uploaded to the bucket:
- If your PUT request does not contain encryption information, the uploaded objects will be encrypted based on the encryption configuration of the bucket.
- If your PUT request contains encryption information, the uploaded objects will be encrypted based on the contained encryption information.
- After encryption is configured for a bucket, for inventory reports delivered to the bucket:
- If encryption is not configured for the inventory, the delivered reports will be encrypted based on the encryption configuration of the bucket.
- If encryption is configured for the inventory, the delivered reports will be encrypted based on the encryption configuration of the inventory.