How to configure server-side encryption

Use Server-Side Encryption with Customer-Provided Keys (SSE-C) to encrypt an object with a 256-bit key that you manage. Quake AI Object Storage applies AES-256 encryption and requires the same key for later read and metadata requests.

Set the object details and generate a key#

Set variables for your bucket, local file, and object key. Generate a 256-bit, Base64-encoded encryption key:

export BUCKET_NAME="YOUR_BUCKET_NAME"
export SOURCE_FILE="PATH_TO_YOUR_FILE"
export OBJECT_KEY="YOUR_OBJECT_KEY"
export SSE_C_KEY="$(openssl rand -base64 32)"

Store SSE_C_KEY in your key-management system before uploading the object. The shell variable lasts only for the current shell session.

Upload the encrypted object#

aws s3api put-object \
  --bucket "$BUCKET_NAME" \
  --key "$OBJECT_KEY" \
  --body "$SOURCE_FILE" \
  --sse-customer-algorithm AES256 \
  --sse-customer-key "$SSE_C_KEY" \
  --endpoint-url "https://object.us-east-1.rumble.cloud"

Verify the encrypted object#

Provide the same algorithm and key when you request object metadata:

aws s3api head-object \
  --bucket "$BUCKET_NAME" \
  --key "$OBJECT_KEY" \
  --sse-customer-algorithm AES256 \
  --sse-customer-key "$SSE_C_KEY" \
  --endpoint-url "https://object.us-east-1.rumble.cloud"

The response includes the object's content length, content type, last-modified time, ETag, and customer-key MD5. The ETag for an SSE-C object is not an MD5 hash of the object data.

The gateway returns 400 Bad Request if a head-object request omits the SSE-C headers. A get-object request without those headers returns InvalidArgument.

Download the encrypted object#

Provide the key with each download request:

aws s3api get-object \
  --bucket "$BUCKET_NAME" \
  --key "$OBJECT_KEY" \
  --sse-customer-algorithm AES256 \
  --sse-customer-key "$SSE_C_KEY" \
  --endpoint-url "https://object.us-east-1.rumble.cloud" \
  "DECRYPTED_OUTPUT_FILE"

Compare the downloaded file with the source:

cmp "$SOURCE_FILE" "DECRYPTED_OUTPUT_FILE"

cmp exits without output when the files match.

Delete an encrypted object#

Deleting an SSE-C object requires permission to delete the object. It does not require the encryption key:

aws s3api delete-object \
  --bucket "$BUCKET_NAME" \
  --key "$OBJECT_KEY" \
  --endpoint-url "https://object.us-east-1.rumble.cloud"

Restrict delete permissions separately from access to the encryption key. Enable object versioning if you need to recover an object after an accidental delete.

Troubleshoot SSE-C requests#

• The AWS CLI reports an unknown option: Use --sse-customer-algorithm and --sse-customer-key. The longer --server-side-encryption-customer-* option names are not valid AWS CLI flags.
• The gateway rejects the key: Generate a 256-bit, Base64-encoded key with openssl rand -base64 32.
• A read or metadata request fails: Provide the algorithm and key used for the upload.
• The downloaded file does not match: Confirm that the request targets the correct bucket and object key, then compare it with cmp.
• The request uses HTTP: Change the endpoint to HTTPS. SSE-C requests require an encrypted connection.

Next steps#

• Enable object versioning
• Grant access to object storage
• Access an uploaded object