How To Set Up Server Side Encryption For Amazon S3 Managed Keys
ObjectiveFS provides client-side encryption, which encrypts the data on your server before it is sent to the object store. The data stays encrypted in transit and at rest. The client-side encryption is always enabled.
For enterprise users, ObjectiveFS also supports server-side encryption on AWS using Amazon S3-managed encryption keys (SSE-S3) and AWS KMS-managed encryption keys (SSE-KMS). This guide describes how to set up ObjectiveFS to run with Amazon S3 Managed Keys
Nothing To Set Up: SSE-S3 Is The Bucket Default
Since January 5, 2023, Amazon S3 automatically applies server-side encryption with S3 managed keys (SSE-S3, 256-bit AES) to every new object in every bucket. It is enabled at the bucket level, comes at no additional cost, has no performance impact, and cannot be disabled. This bucket-level default is the recommended way to run with SSE-S3: there is nothing to configure, on the bucket or in ObjectiveFS.
You can verify it on your bucket: in the S3 console, select your bucket, open the Properties tab and check Default encryption.
Note: Objects written before 2023-01-05 to a bucket without default encryption are not retroactively encrypted. ObjectiveFS compacts data in the background, so on an active filesystem older objects are progressively rewritten, and every rewrite is encrypted under the bucket default.
Explicitly Requesting SSE Per Upload (Optional)
If your compliance rules require the encryption header on every request (or your bucket predates the default and you want SSE-S3 without waiting for rewrites), ObjectiveFS can request SSE-S3 explicitly on every upload:
In /etc/objectivefs.env, create a file named AWS_SERVER_SIDE_ENCRYPTION with content as AES256
# echo "AES256" > /etc/objectivefs.env/AWS_SERVER_SIDE_ENCRYPTION
Create a filesystem (one-time only) and mount the filesystem as usual.
# sudo mount.objectivefs create myfs
# sudo mount.objectivefs myfs /ofs
For AWS KMS managed keys (SSE-KMS, with KMS request charges and quotas), see server side encryption for AWS KMS.
Reference
- Server Side Encryption section in User Guide
- Filesystem Commands section in User Guide
If you have questions, please email us at support@objectivefs.com.
Last updated ObjectiveFS staff
ObjectiveFS is a shared filesystem for Linux and macOS that automatically scales up and out with high performance. In production use by Fortune 500 companies since 2013.