Data Encryption (SSE)
MinIO Server-Side Encryption (SSE) protects objects as part of write operations, allowing clients to take advantage of server processing power to secure objects at the storage layer (encryption-at-rest). SSE also provides key functionality to regulatory and compliance requirements around secure locking and erasure.
MinIO SSE uses the PGSTY KES and an external Key Management Service (KMS) for performing secured cryptographic operations at scale. MinIO also supports client-managed key management, where the application takes full responsibility for creating and managing encryption keys for use with MinIO SSE.
The maintained integration is SILO + PGSTY KES + OpenBao KV v2. Other inherited KES backends require separate validation. The following links describe those integrations:
- OpenBao / HashiCorp Vault
- AWS SecretsManager
- Google Cloud SecretManager
- Azure Key Vault
- Fortanix SDKMS
- Thales Digital Identity and Security (formerly Gemalto)
MinIO SSE requires enabling Network Encryption (TLS).
Supported Encryption Types
SILO implements the S3 encryption request interfaces described in AWS Server-Side Encryption and supports the following encryption strategies:
MinIO supports enabling automatic SSE-KMS encryption of all objects written to a bucket using a specific External Key (EK) stored on the external KMS. Clients can override the bucket-default EK by specifying an explicit key as part of the write operation.
For buckets without automatic SSE-KMS encryption, clients can specify an EK as part of the write operation instead.
SILO can encrypt backend IAM/configuration data through the configured KMS. You can clear a bucket default with mcli encrypt clear, but existing encrypted data still requires its original keys. Do not remove the key service while that data depends on it.
SSE-KMS provides more granular and customizable encryption compared to SSE-S3 and SSE-C and is recommended over the other supported encryption methods.
For a tutorial on enabling SSE-KMS in a local (non-production) MinIO Deployment, see Quickstart.
MinIO supports enabling automatic SSE-S3 encryption of all objects written to a bucket using an EK stored on the external KMS. MinIO SSE-S3 supports one EK for the entire deployment.
For buckets without automatic SSE-S3 encryption, clients can request SSE encryption as part of the write operation instead.
SILO can encrypt backend IAM/configuration data through the configured KMS. You can clear a bucket default with mcli encrypt clear, but existing encrypted data still requires its original keys. Do not remove the key service while that data depends on it.
For a tutorial on enabling SSE-s3 in a local (non-production) MinIO Deployment, see Quickstart.
Clients specify an EK as part of the write operation for an object. SILO uses the client-supplied key for SSE-C. SSE-C does not require KES or a server-side KMS.
SSE-C does not support bucket-default encryption settings and requires clients perform all key management operations.
Server-Side Object Encryption with KES
Deploy Silo with server-side object encryption