Object Storage Data Encryption

Using optional API headers, you can provide your own 256-bit AES encryption key that is used to encrypt and decrypt objects uploaded to and downloaded from Object Storage:

• When you upload an object, you supply the encryption key. Object Storage encrypts the object using that key and immediately deletes the key.
• When you want to download an object, you supply the same key that was used to encrypt the object and Object Storage decrypts and returns the object to you.

You manage the encryption keys and Object Storage manages the encryption and decryption.

Understand the following scope and constraints regarding SSE-C:

• An SSE-C key cannot be associated with a bucket and can only be used to encrypt individual objects.
• You can encrypt objects using your own encryption key using pre-authenticated requests. To retrieve an SSE-C encrypted object using a pre-authenticated request, you need to specify your encryption key.
• To delete or rename an SSE-C encrypted object, you do not need to specify your encryption key.
• You can only specify either a kmsKeyId or an sseCustomerKey in the ReencryptObject request payload, not both. If the request payload is empty, the object is encrypted using the encryption key assigned to the bucket. The bucket encryption mechanism can either be a master encryption key managed by Oracle or the Vault service.
• You can only use the Object Storage APIs and the CLI to provide SSE-C keys. You can't use the Console to upload or retrieve objects using a customer-provided key.
• The Amazon S3 Compatibility API also supports SSE-C.

If you want to use your own keys for server-side encryption, specify the following three request headers with the encryption key information:

For CopyObject:

If the source object is encrypted with an SSE-C key, you must also specify the following three headers so that Object Storage can decrypt the object.

You can also use your own encryption keys to encrypt objects using the CLI.

You can supply your own encryption key using the optional parameter --encryption-key-file filename for the following commands:

• oci os object put
• oci os object get
• oci os object head
• oci os object resume-put
• oci os object bulk-upload
• oci os object bulk-download
• oci os object copy
• oci os object reencrypt

filename points to a file containing the base64-encoded string of the AES-256 encryption key. No other parameters are required. Object Storage decodes the key to compute the SHA256 hash of the encryption key.

If the source object is encrypted with an SSE-C key, you must also specify the optional parameter --source-encryption-key-file filename for the following commands:

• oci os object copy
• oci os object reencrypt

filename points to a file containing the base64-encoded string of the AES-256 source encryption key. No other parameters are required. Object Storage decodes the key to compute the SHA256 hash of the source encryption key.

For information about using the CLI, see Command Line Interface (CLI). For a complete list of flags and options available for CLI commands, see the Command Line Reference.

You can use your own encryption keys in Vault to encrypt objects using the CLI.

You can supply your own encryption key using the optional parameter --opc-sse-kms-key-id target_key_id for the following commands:

• oci os object put
• oci os object copy

target_key_id is the OCID of an existing key in the Vault to be used to encrypt the object.

An example to upload an object to the bucket using a key in Vault:

oci os object put -bn "MyKeyBucket" --name "MyObjectName" --file "InputFile" --opc-sse-kms-key-id "ocid1.key.region1.sea..exampleuniqueID"

Uploading object  [####################################]  100%
{
  "etag": "cadb9f8a-3292-45e6-a1e8-f075699fb619",
  "last-modified": "Tue, 13 Jul 2021 05:52:47 GMT",
  "opc-content-md5": "9KJsgOK/X5C1sARb2tkhVA=="
}

An example to perform a multipart upload using a key in Vault:

oci os object put --bucket-name MyBucket --name MyObjectName --file  ~/path/to/file  --parallel-upload-count 10 --part-size 500 --opc-sse-kms-key-id ocid1.key.oc1.region1.sea..exampleuniqueID
Upload ID: 813bb394-377d-d5cf-cb3f-31b025346199
Split file into 1 parts for upload.
Uploading object  [####################################]  100%
{
"etag": "a55f1c69-1cf4-4134-9113-7a866bac712f",
"last-modified": "Wed, 29 May 2024 21:54:55 GMT",
"opc-multipart-md5": "sAVJt/6nEVizTbwRblZZSg==-1"
}

An example to copy an object using a key in Vault:

oci os object copy --bucket-name MyBucket1 --destination-bucket MyBucket2 --source-object-name MyObjectName --opc-sse-kms-key-id ocid1.key.oc1.region1.sea..exampleuniqueID
{
"opc-work-request-id": "115e230c-04b8-4dc6-89eb-7e1269b4ab47"
}

For information about using the CLI, see Command Line Interface (CLI). For a complete list of flags and options available for CLI commands, see the Command Line Reference.

If you want to use your own keys in Vault for server-side encryption, specify the following request header with the OCID of the key in Vault:

For information about using the API and signing requests, see REST API documentation and Security Credentials. For information about SDKs, see SDKs and the CLI.