[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tutorials](index.md) > Server-side encryption

# Server-side encryption

# Server-side encryption for an Object Storage bucket


In this tutorial, you will enable bucket encryption. As a symmetric encryption key, you will use a [Yandex Key Management Service key](../../kms/concepts/key.md). This key will subject all new bucket objects to [envelope encryption](../../kms/concepts/envelope.md).


To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer):

* `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects.
* `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects.
* `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter).

For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles).


To enable server-side bucket encryption:

1. [Get your cloud ready](#before-you-begin).
1. [Create a bucket](#create-bucket).
1. [Create a key](#create-key).
1. [Enable encryption](#enable-encryption).

If you no longer need to encrypt new bucket objects, [disable encryption](#disable-encryption).

## Get your cloud ready {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).


### Required paid resources {#paid-resources}

The cost of maintaining a bucket with encryption includes:

* Fee for storing data in a bucket (see [Object Storage pricing](../pricing.md#prices-storage)).
* Fee for data operations (see [Object Storage pricing](../pricing.md#prices-operations)).
* Fee for using KMS keys (see [Key Management Service pricing](../../kms/pricing.md#prices)).


## Create a bucket {#create-bucket}

You can create a new bucket or use an existing one. To create a bucket, run:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a bucket.
  1. Navigate to **Object Storage**.
  1. Click **Create bucket**.
  1. In the ** Name** field, enter a name for the bucket.

     The name must meet the following requirements:

     * The name must be from 3 to 63 characters long.
     * The name may contain lowercase Latin letters, numbers, hyphens, and periods.
     * The first and last characters must be letters or numbers.
     * The characters to the right and left of the period must be letters or numbers.
     * The name must not look like an IP address, e.g., `10.1.3.9`.

  1. Specify the maximum size of the bucket in GB.
  1. In the **Read objects**, **Read object list**, and **Read settings** fields, select **With authorization**.
  1. Click **Create bucket**.

- AWS CLI {#aws-cli}

  1. If you do not have the AWS CLI yet, [install and configure it](../tools/aws-cli.md).

  1. Run this command:

      ```bash
      aws s3 mb s3://<bucket_name> --endpoint-url=https://storage.yandexcloud.net
      ```

      Result:

      ```text
      make_bucket: <bucket_name>
      ```

- Terraform {#tf}

  {% note info %}
  
  If you access Object Storage via Terraform under a [service account](../../iam/concepts/users/service-accounts.md), [assign](../../iam/operations/sa/assign-role-for-sa.md) to the service account the relevant [role](../security/index.md#roles-list), e.g., `storage.admin`, for the folder you are going to create the resources in.
  
  {% endnote %}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Describe the resources in the configuration file. In this tutorial, settings are specified under `locals`:

      ```
      locals {
        cloud_id    = "<cloud_ID>"
        folder_id   = "<folder_ID>"
        zone        = "ru-central1-a"

        sa_name     = "new-buckets-account"
        sa_desc     = "Account for managing Object Storage buckets"
        sa_key_desc = "Static key for ${local.sa_name}"

        bucket_name = "Bucket name" # Name of the bucket you are creating. If you do not specify a bucket name for the `yandex_storage_bucket` resource, the name will be generated automatically.
      }

      terraform {
        required_providers {
          yandex = {
            source = "yandex-cloud/yandex"
          }
        }
      }

      provider "yandex" {
        cloud_id  = local.cloud_id
        folder_id = local.folder_id
        zone      = local.zone
      }

      resource "yandex_iam_service_account" "buckets-account" {
        name        = local.sa_name
        description = local.sa_desc
      }

      resource "yandex_resourcemanager_folder_iam_member" "buckets-account-role" {
        folder_id = local.folder_id
        role      = "editor"
        member    = "serviceAccount:${yandex_iam_service_account.buckets-account.id}"
      }

      resource "yandex_iam_service_account_static_access_key" "buckets-account-key" {
        service_account_id = "${yandex_iam_service_account.buckets-account.id}"
        description        = local.sa_key_desc
      }

      resource "yandex_storage_bucket" "test" {
        bucket     = local.bucket_name
        access_key = "${yandex_iam_service_account_static_access_key.buckets-account-key.access_key}"
        secret_key = "${yandex_iam_service_account_static_access_key.buckets-account-key.secret_key}"
      }
      ```

      For more information about the resources you can create with [Terraform](https://www.terraform.io/docs/language/index.html), see [this provider guide](../../terraform/index.md).

  1. Make sure the configuration files are correct.

      1. In the terminal, navigate to the directory where you created your configuration file.

      1. Run a check using this command:

        ```bash
        terraform plan
        ```

        If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors.

  1. Deploy the cloud resources.

      1. If the configuration is correct, run this command:

          ```bash
          terraform apply
          ```

      1. Confirm creating the resources.

          After the command is executed, Terraform will update or create the following resources in the specified folder:

          * `new-buckets-account` service account.
          * The `editor` role for the `new-buckets-account` service account.
          * Static key for the service account.
          * Bucket.

          You can check the new resources using the [management console](https://console.yandex.cloud).

{% endlist %}

## Create a key {#create-key}

Create a new key or use an existing one. To create a key:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a key.
  1. Navigate to **Key Management Service**.
  1. Click **Create key**.
  1. In the window that opens:

      * In the **Name** field, specify `bucket-key`.
      * In the **Encryption algorithm** field, select `AES-256`.
      * In the **Rotation period, days** field, set the [rotation](../../kms/concepts/version.md#rotate-key) period to `7 days`.
      * Click **Create**.

  When creating a key, you create its first version; to open a page with its attributes, click the key in the list.

- Yandex Cloud CLI {#cli}

  Run this command:

  ```bash
  yc kms symmetric-key create \
    --name bucket-key \
    --default-algorithm aes-256 \
    --rotation-period 168h
  ```

  Where:

  * `--name`: Key name.
  * `--default-algorithm`: Encryption algorithm: `aes-128`, `aes-192`, or `aes-256`.
  * `--rotation-period`: Key rotation period. The value is set in hours, minutes, and seconds and cannot be less than 24 hours, e.g., `--rotation-period 27h14m27s`.

      To create a key without automatic rotation, do not specify the `--rotation-period` parameter.

  When creating a key, you create its first version. It is specified in the `primary_version` field.

- Terraform {#tf}

  1. Describe the resources in the configuration file. In this tutorial, settings are specified under `locals`:

      ```
      locals {
        cloud_id    = "<cloud_ID>"
        folder_id   = "<folder_ID>"
        zone        = "ru-central1-a"

        sa_name     = "new-buckets-account"
        sa_desc     = "Account for managing Object Storage buckets"
        sa_key_desc = "Static key for ${local.sa_name}"

        key_name    = "bucket-key" # KMS key name
        key_desc    = "Bucket encryption key"

        bucket_name = "Bucket name"
      }

      terraform {
        required_providers {
          yandex = {
            source = "yandex-cloud/yandex"
          }
        }
      }

      provider "yandex" {
        cloud_id  = local.cloud_id
        folder_id = local.folder_id
        zone      = local.zone
      }

      resource "yandex_iam_service_account" "buckets-account" {
        name        = local.sa_name
        description = local.sa_desc
      }

      resource "yandex_resourcemanager_folder_iam_member" "buckets-account-role" {
        folder_id = local.folder_id
        role      = "editor"
        member    = "serviceAccount:${yandex_iam_service_account.buckets-account.id}"
      }

      resource "yandex_iam_service_account_static_access_key" "buckets-account-key" {
        service_account_id = "${yandex_iam_service_account.buckets-account.id}"
        description        = local.sa_key_desc
      }

      resource "yandex_kms_symmetric_key" "key-a" {
        name              = local.key_name
        description       = local.key_desc
        default_algorithm = "AES_256"
        rotation_period   = "168h"
      }

      resource "yandex_storage_bucket" "test" {
        bucket     = local.bucket_name
        access_key = "${yandex_iam_service_account_static_access_key.buckets-account-key.access_key}"
        secret_key = "${yandex_iam_service_account_static_access_key.buckets-account-key.secret_key}"
      }
      ```

  1. Make sure the configuration files are correct.

      1. In the terminal, navigate to the directory where you created your configuration file.

      1. Run a check using this command:

          ```bash
          terraform plan
          ```

          If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors.

  1. Deploy the cloud resources.

      1. If the configuration is correct, run this command:

          ```bash
          terraform apply
          ```

      1. Confirm creating the resources.

          After the command is executed, Terraform will update or create the following resources in the specified folder:

          * `new-buckets-account` service account.
          * The `editor` role for the `new-buckets-account` service account.
          * Static key for the service account.
          * KMS key named `bucket-key`.
          * Bucket.

          You can check the new resources using the [management console](https://console.yandex.cloud).

- API {#api}

  Use the [create](../../kms/api-ref/SymmetricKey/create.md) method for the `SymmetricKey` resource.

{% endlist %}

## Enable encryption {#enable-encryption}

To enable bucket encryption with a KMS key:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder with the bucket.
  1. Navigate to **Object Storage**.
  1. Select the previously created bucket.
  1. In the left-hand panel, select **Security**.
  1. Open the **Encryption** tab.
  1. In the **KMS Key** field, select `bucket-key`.
  1. Click **Save**.

- AWS CLI {#aws-cli}

  Run this command:

  ```
  aws s3api put-bucket-encryption \
    --bucket <bucket_name> \
    --endpoint-url=https://storage.yandexcloud.net \
    --server-side-encryption-configuration '{
    "Rules": [
      {
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "<KMS_key_ID>"
      },
      "BucketKeyEnabled": true
    }
    ]
  }'
  ```

- Terraform {#tf}

  1. Describe the resources in the configuration file. In this tutorial, settings are specified under `locals`:

      ```
      locals {
        cloud_id    = "<cloud_ID>"
        folder_id   = "<folder_ID>"
        zone        = "ru-central1-a"
        sa_name     = "new-buckets-account"
        sa_desc     = "Account for managing Object Storage buckets"
        sa_key_desc = "Static key for ${local.sa_name}"
        key_name    = "bucket-key" # KMS key name
        key_desc    = "Bucket encryption key"
        bucket_name = "Bucket name" # Bucket name.
      }

      terraform {
        required_providers {
          yandex = {
            source = "yandex-cloud/yandex"
          }
        }
      }

      provider "yandex" {
        cloud_id  = local.cloud_id
        folder_id = local.folder_id
        zone      = local.zone
      }

      resource "yandex_iam_service_account" "buckets-account" {
        name        = local.sa_name
        description = local.sa_desc
      }

      resource "yandex_resourcemanager_folder_iam_member" "buckets-account-role" {
        folder_id = local.folder_id
        role      = "editor"
        member    = "serviceAccount:${yandex_iam_service_account.buckets-account.id}"
      }

      resource "yandex_iam_service_account_static_access_key" "buckets-account-key" {
        service_account_id = "${yandex_iam_service_account.buckets-account.id}"
        description        = local.sa_key_desc
      }

      resource "yandex_kms_symmetric_key" "key-a" {
        name              = local.key_name
        description       = local.key_desc
        default_algorithm = "AES_256"
        rotation_period   = "168h"
      }

      resource "yandex_storage_bucket" "test" {
        bucket     = local.bucket_name
        access_key = "${yandex_iam_service_account_static_access_key.buckets-account-key.access_key}"
        secret_key = "${yandex_iam_service_account_static_access_key.buckets-account-key.secret_key}"
        server_side_encryption_configuration {
          rule {
          apply_server_side_encryption_by_default {
            kms_master_key_id = yandex_kms_symmetric_key.key-a.id
            sse_algorithm     = "aws:kms"
          }
        }
        }
      }
      ```

  1. Make sure the configuration files are correct.

      1. In the terminal, navigate to the directory where you created your configuration file.

      1. Run a check using this command:

          ```bash
          terraform plan
          ```

          If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors.

  1. Deploy the cloud resources.

      1. If the configuration is correct, run this command:

          ```bash
          terraform apply
          ```

      1. Confirm creating the resources.

          After the command is executed, Terraform will update or create the following resources in the specified folder:

          * `new-buckets-account` service account.
          * The `editor` role for the `new-buckets-account` service account.
          * Static key for the service account.
          * KMS key named `bucket-key`.
          * Bucket with encryption.

          You can check the new resources using the [management console](https://console.yandex.cloud).

{% endlist %}

Now all new objects in the bucket will be encrypted with `bucket-key`.

## Disable encryption {#disable-encryption}

If you no longer need to encrypt new bucket objects, disable encryption.

{% note alert %}

After you disable bucket encryption, previously uploaded objects will be stored in encrypted form. Data in Object Storage is subject to [envelope encryption](../../kms/concepts/envelope.md). Deleting a key is the same as destroying all data encrypted with that key.

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder with the bucket.
  1. Navigate to **Object Storage**.
  1. Select the previously created bucket.
  1. In the left-hand panel, select **Security**.
  1. Open the **Encryption** tab.
  1. In the **KMS Key** field, select `Not selected`.
  1. Click **Save**.

- AWS CLI {#aws-cli}

  Run this command:

  ```bash
  aws s3api delete-bucket-encryption \
    --bucket <bucket_name> \
    --endpoint-url=https://storage.yandexcloud.net
  ```

- Terraform {#tf}

  1. Describe the resources in the configuration file. To disable encryption, delete or comment out the `server_side_encryption_configuration` section for the `yandex_storage_bucket` resource:

      ```
      locals {
        cloud_id    = "<cloud_ID>"
        folder_id   = "<folder_ID>"
        zone        = "ru-central1-a"
        sa_name     = "new-buckets-account"
        sa_desc     = "Account for managing Object Storage buckets"
        sa_key_desc = "Static key for ${local.sa_name}"
        key_name    = "bucket-key"
        key_desc    = "Bucket encryption key"
        bucket_name = "Bucket name"
      }

      terraform {
        required_providers {
          yandex = {
            source = "yandex-cloud/yandex"
          }
        }
      }

      provider "yandex" {
        cloud_id  = local.cloud_id
        folder_id = local.folder_id
        zone      = local.zone
      }

      resource "yandex_iam_service_account" "buckets-account" {
        name        = local.sa_name
        description = local.sa_desc
      }

      resource "yandex_resourcemanager_folder_iam_member" "buckets-account-role" {
        folder_id = local.folder_id
        role      = "editor"
        member    = "serviceAccount:${yandex_iam_service_account.buckets-account.id}"
      }

      resource "yandex_iam_service_account_static_access_key" "buckets-account-key" {
        service_account_id = "${yandex_iam_service_account.buckets-account.id}"
        description        = local.sa_key_desc
      }

      resource "yandex_kms_symmetric_key" "key-a" {
        name              = local.key_name
        description       = local.key_desc
        default_algorithm = "AES_256"
        rotation_period   = "168h"
      }

      resource "yandex_storage_bucket" "test" {
        bucket     = local.bucket_name
        access_key = "${yandex_iam_service_account_static_access_key.buckets-account-key.access_key}"
        secret_key = "${yandex_iam_service_account_static_access_key.buckets-account-key.secret_key}"
        /*
          server_side_encryption_configuration {
            rule {
            apply_server_side_encryption_by_default {
              kms_master_key_id = yandex_kms_symmetric_key.key-a.id
              sse_algorithm     = "aws:kms"
            }
          }
          }
        */
      }
      ```

  1. Make sure the configuration files are correct.

      1. In the terminal, navigate to the directory where you created your configuration file.
      1. Run a check using this command:

          ```bash
          terraform plan
          ```

          If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors.

  1. Deploy the cloud resources.

      1. If the configuration is correct, run this command:

          ```bash
          terraform apply
          ```

      1. Confirm updating the resources.

          After the command is executed, Terraform will update the following resources in the specified folder:

          * `new-buckets-account` service account.
          * The `editor` role for the `new-buckets-account` service account.
          * Static key for the service account.
          * KMS key named `bucket-key`.
          * Bucket.

{% endlist %}

This will disable bucket encryption in the specified folder. You can check the resource update and configuration using the [management console](https://console.yandex.cloud).