Server-Side Encryption of Objects on SILO

Server-Side Encryption with Per-Bucket Keys (SSE-KMS)

Mon, 01 Jan 0001 00:00:00 +0000

MinIO Server-Side Encryption (SSE) protects objects as part of write operations, allowing clients to take advantage of server processing power to secure objects at the storage layer (encryption-at-rest). SSE also provides key functionality to regulatory and compliance requirements around secure locking and erasure.

MinIO SSE uses the MinIO Key Encryption Service (KES) and a supported external Key Management Service (KMS) for performing secured cryptographic operations at scale. MinIO also supports client-managed key management, where the application takes full responsibility for creating and managing encryption keys for use with MinIO SSE.

Server-Side Encryption Per-Deployment Key (SSE-S3)

Mon, 01 Jan 0001 00:00:00 +0000

MinIO SSE uses the MinIO Key Encryption Service (KES) and an external Key Management Service (KMS) for performing secured cryptographic operations at scale. MinIO also supports client-managed key management, where the application takes full responsibility for creating and managing encryption keys for use with MinIO SSE.

Server-Side Encryption with Client-Managed Keys (SSE-C)

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page configures and enables Server-Side Encryption with Client-Managed Keys (SSE-C). MinIO SSE-C supports client-driven encryption of objects before writing the object to the drive. Clients must specify the correct key to decrypt objects for read operations.