`mc encrypt set`

Syntax

The mc encrypt set encrypt command sets or updates the default bucket Server-Side Encryption (SSE) mode. MinIO automatically encrypts objects written to that bucket using the specified SSE mode.

mc encrypt set only supports SSE-KMS and SSE-S3.

EXAMPLE

The following command sets the default SSE-KMS encryption key for the bucket mydata on the myminio MinIO deployment:

mc encrypt set sse-kms "minio-encryption-key" myminio/mydata

SYNTAX

The command has the following syntax:

mc [GLOBALFLAGS] encrypt set  ENCRYPTION [KMSKEY] ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Parameters

ENCRYPTION

Specify the server-side encryption type to use as the default SSE mode. Supports the following values:

sse-kms - Encrypt objects using the key specified in KMSKEY. MinIO must have access to the specified key on the external KMS to successfully encrypt or decrypt objects protected using SSE-KMS.
sse-s3 - Encrypt objects using the key specified to MINIO_KMS_KES_KEY_NAME. MinIO must have access to the specified key on the external KMS to successfully encrypt or decrypt objects protected using SSE-S3.

KMSKEY

Specify the KMS Master Key to use for performing SSE object encryption. This option only applies if ENCRYPTION is sse-kms.

Omit this option to direct MinIO to use the MINIO_KMS_KES_KEY_NAME.

ALIAS

The full path to the bucket on which to set the default SSE mode. Specify the alias of the MinIO deployment as the prefix to the TARGET path. For example:

mc encrypt set ENCRYPTION [KMSKEY] play/mybucket

Global Flags

This command supports any of the global flags.

Examples

Enable Automatic Server-Side Bucket Encryption

Example

The following commands assumes that:

The MinIO server configuration supports SSE-KMS
The root has an encryption key minio-encryption-key.

 mc encrypt set sse-kms minio-encryption-key myminio/data

Syntax

mc encrypt set ENCRYPTION KMSKEY TARGET

Replace ENCRYPTION with sse-kms or sse-s3 depending on the preferred encryption mode.
Replace KMSKEY with the name of the encryption key on the configured root KMS. This argument has no effect with sse-s3.
Replace TARGET with the alias of the MinIO deployment on which to configure automatic server-side bucket encryption.

Behavior

mc encrypt set makes no assumptions about the MinIO server’s current encryption state. Specifying default encryption settings which the server cannot support may result in undesired behavior.

Setting or modifying the default server-side encryption settings does not automatically encrypt or decrypt the existing bucket contents. If the bucket contents must have consistent encryption, use the mc mv command with --enc-kms, --enc-s3, or --enc-c to specify the type of encryption to use for the moved contents. This manually modifies the encryption settings or encrypted state of the bucket contents before changing the bucket default.