[Yandex Cloud documentation](../../../index.md) > [Yandex Object Storage](../../index.md) > [Step-by-step guides](../index.md) > Buckets > Encrypting a bucket

# Bucket encryption


In Object Storage, you can encrypt objects in a bucket using [KMS keys](../../../kms/concepts/key.md) in any of the following ways:
* [Set up encryption for the bucket](#add) to encrypt all new objects with the specified key.
* Specify an encryption key when [uploading an object using the API](../../s3/api-ref/object/upload.md).

{% note alert %}

Object Storage employs [envelope encryption](../../../kms/concepts/envelope.md) to secure data. Deleting a key is the same as deleting all data encrypted with that key.

{% endnote %}


To work with objects in an [encrypted](../../concepts/encryption.md) bucket, a user or [service account](../../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../../security/index.md#storage-configurer):

* `kms.keys.encrypter`: To read the key, [encrypt](../../../kms/security/index.md#kms-keys-encrypter) and upload objects.
* `kms.keys.decrypter`: To read the key, [decrypt](../../../kms/security/index.md#kms-keys-decrypter) and download objects.
* `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../../kms/security/index.md#kms-keys-encrypterDecrypter).

For more information, see [Key Management Service service roles](../../../kms/security/index.md#service-roles).


## Setting up encryption for a bucket {#add}

{% list tabs group=instructions %}

- Management console {#console}

  To add a KMS key:
  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Select the bucket you want to configure encryption for.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/persons-lock.svg) **Security**.
  1. Select the **Encryption** tab.
  1. In the **KMS Key** field, select an existing key or create a new one:

     1. If the folder does not contain any keys yet, click **Create key**. If the folder contains keys but they are not suitable, click **Create**.
     1. Enter a name for the key.
     1. Select an encryption algorithm and a rotation period.
     1. Click **Create**.

  1. Click **Save**.

- Terraform {#tf}

  {% note info %}
  
  If you access Object Storage via Terraform under a [service account](../../../iam/concepts/users/service-accounts.md), [assign](../../../iam/operations/sa/assign-role-for-sa.md) to the service account the relevant [role](../../security/index.md#roles-list), e.g., `storage.admin`, for the folder you are going to create the resources in.
  
  {% endnote %}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  Before you start, [get an IAM token](../../../iam/operations/iam-token/create-for-sa.md#via-cli) for your service account and save it to a file.


  1. In the configuration file, specify the properties of the resources you want to create:

     ```hcl
     provider "yandex" {
       cloud_id                 = "<cloud_ID>"
       folder_id                = "<folder_ID>"
       zone                     = "ru-central1-a"
       service_account_key_file = "key.json"
     }

     resource "yandex_iam_service_account" "sa" {
       name = "<service_account_name>"
     }

     // Assigning a role to a service account
     resource "yandex_resourcemanager_folder_iam_member" "sa-admin" {
       folder_id = "<folder_ID>"
       role      = "storage.admin"
       member    = "serviceAccount:${yandex_iam_service_account.sa.id}"
     }

     // Creating a static access key
     resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
       service_account_id = yandex_iam_service_account.sa.id
       description        = "static access key for object storage"
     }

     resource "yandex_kms_symmetric_key" "key-a" {
       name              = "<key_name>"
       description       = "<key_description>"
       default_algorithm = "AES_128"
       rotation_period   = "8760h" // 1 year
     }

     resource "yandex_storage_bucket" "test" {
       bucket     = "<bucket_name>"
       access_key = yandex_iam_service_account_static_access_key.sa-static-key.access_key
       secret_key = yandex_iam_service_account_static_access_key.sa-static-key.secret_key
       server_side_encryption_configuration {
         rule {
           apply_server_side_encryption_by_default {
             kms_master_key_id = yandex_kms_symmetric_key.key-a.id
             sse_algorithm     = "aws:kms"
           }
         }
       }
     }
     ```

     Where:

     * `service_account_key_file`: Path to the file with your service account's IAM token (or the file contents).
     * `default_algorithm`: Encryption algorithm to use with a new [key version](../../../kms/concepts/version.md). A new version of the key is generated with each key rotation. The default value is `AES_128`.
     * `rotation_period`: [Rotation period](../../../kms/concepts/version.md#rotate-key). To disable automatic rotation, skip this parameter.
     * `apply_server_side_encryption_by_default`: Default encryption settings on the server side:
       * `kms_master_key_id`: ID of the KMS master key used for encryption.
       * `sse_algorithm`: Encryption algorithm used on the server side. The only supported value is `aws:kms`.

     For more information about the `yandex_storage_bucket` properties in Terraform, see [this provider guide](../../../terraform/resources/storage_bucket.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the update using the [management console](https://console.yandex.cloud).

{% endlist %}

## Removing bucket encryption {#del}

{% list tabs group=instructions %}

- Management console {#console}

  To remove encryption, delete the KMS key:
  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Select the bucket you want to remove encryption for.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/persons-lock.svg) **Security**.
  1. Select the **Encryption** tab.
  1. In the **KMS Key** field, select **Not selected**.
  1. Click **Save**.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the relevant documentation on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  
  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.



  To remove encryption for a bucket created using Terraform:

  1. Open the Terraform configuration file and delete the `server_side_encryption_configuration` section from the bucket description.

     {% cut "Example of a bucket description in Terraform configuration" %}

     ```hcl
     ...
     resource "yandex_storage_bucket" "test" {
       bucket     = "my-bucket"
       access_key = "123JE02jKxusn********"
       secret_key = "ExamP1eSecReTKeykdo********"
       server_side_encryption_configuration { // Delete this section to disable encryption
         rule {
           apply_server_side_encryption_by_default {
             kms_master_key_id = "abjbeb2bgg4l********"
             sse_algorithm     = "aws:kms"
           }
         }
       }
     }
     ...
     ```

     {% endcut %}

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the update using the [management console](https://console.yandex.cloud).

{% endlist %}


#### See also {#see-also}

* [Encryption in Object Storage](../../concepts/encryption.md)