Manage encryption in Object Storage

All data stored in STACKIT Object Storage is encrypted at rest using AES256. In addition, you can use server-side encryption (SSE) or server-side encryption with customer-provided keys (SSE-C) to encrypt individual objects during upload.

Prerequisites

• Object Storage enabled and credentials configured: Enable Object Storage
• AWS CLI installed and configured for STACKIT Object Storage: Set up the AWS CLI

Server-side encryption

SSE encrypts an object with a unique key during upload. The encryption keys are managed by the storage backend.

To enable SSE for an upload, include the following header in your S3 request:

Header	Description
x-amz-server-side-encryption	Enables SSE. Set to AES256.

SSE is supported for the following operations:

• PUT Object
• PUT Object - Copy
• Initiate Multipart Upload

Upload an object with server-side encryption

aws s3 cp ./my-file.txt s3://my-bucket/ \
  --sse AES256 \
  --endpoint-url https://object.storage.eu01.onstackit.cloud

Server-side encryption with customer-provided keys

SSE-C encrypts objects using a key that you provide and manage yourself. The key is used during the operation and is not stored on STACKIT systems.

You are responsible for managing your encryption keys. If you lose a key, you cannot recover the objects encrypted with it.

Key management responsibilities:

• Track the mapping between keys and objects yourself.
• If versioning is enabled, use a unique key for each version and track the mapping between object versions and keys yourself.
• Rotate your keys yourself.

To use SSE-C, include the following headers in your S3 request:

Header	Description
x-amz-server-side-encryption-customer-algorithm	Encryption algorithm. Must be AES256.
x-amz-server-side-encryption-customer-key	Encryption key. Must be 256-bit and base64-encoded.
x-amz-server-side-encryption-customer-key-MD5	MD5 digest of your encryption key. Must be 128-bit and base64-encoded.

SSE-C is supported for the following operations:

• GET Object
• PUT Object
• PUT Object - Copy
• HEAD Object
• Initiate Multipart Upload
• Upload Part
• Upload Part - Copy

When using SSE-C, the ETag in the response is not the MD5 checksum of the object data.

Generate an encryption key

Generate a random 256-bit key and encode it as base64:

openssl rand -base64 32

Store this key securely. You need it for every operation on the encrypted object.

Upload an object with SSE-C

aws s3 cp ./my-file.txt s3://my-bucket/ \
  --sse-c AES256 \
  --sse-c-key <your-base64-encoded-key> \
  --endpoint-url https://object.storage.eu01.onstackit.cloud

Download an object encrypted with SSE-C

You must provide the same key that was used during upload:

aws s3 cp s3://my-bucket/my-file.txt ./my-file-downloaded.txt \
  --sse-c AES256 \
  --sse-c-key <your-base64-encoded-key> \
  --endpoint-url https://object.storage.eu01.onstackit.cloud