AWS S3

Enable default bucket encryption

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Configure default encryption and S3 bucket keys for an existing bucket.

Inputs

Champ

Type

Description

region [required]

enum

default: us-east-1

bucket [required]

string

Enable default encryption for a bucket using server-side encryption with Amazon S3-managed keys (SSE-S3) or customer-managed keys (SSE-KMS). For information about the Amazon S3 default encryption feature, read Amazon S3 Default Bucket Encryption in the Amazon S3 User Guide.

keyType [required]

enum

AES256 or aws:kms. Note that for KMS, bucket-level keys are enabled by default for all new objects. Allowed enum values: AES256,aws:kms

keyName

string

(Optional) The name of the key. This is only applicable when the key_type is aws:kms.

Outputs

Expand All

Champ

Type

Description

rules

[object]

A container for information about a server-side encryption configuration rule.

ApplyServerSideEncryptionByDefault

object

Specifies the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn't specify any server-side encryption, this default encryption will be applied.

SSEAlgorithm [required]

string

Server-side encryption algorithm to use for the default encryption.

KMSMasterKeyID

string

Amazon Web Services Key Management Service (KMS) customer Amazon Web Services KMS key ID to use for the default encryption. This parameter is allowed if and only if SSEAlgorithm is set to aws:kms. You can specify the key ID or the Amazon Resource Name (ARN) of the KMS key. However, if you are using encryption with cross-account or Amazon Web Services service operations you must use a fully qualified KMS key ARN. For more information, see Using encryption for cross-account operations. For example:
Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
Amazon S3 only supports symmetric KMS keys and not asymmetric KMS keys. For more information, see Using symmetric and asymmetric keys in the Amazon Web Services Key Management Service Developer Guide.

BucketKeyEnabled

boolean

Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket. Existing objects are not affected. Setting the BucketKeyEnabled element to true causes Amazon S3 to use an S3 Bucket Key. By default, S3 Bucket Key is not enabled. For more information, see Amazon S3 Bucket Keys in the Amazon S3 User Guide.

amzRequestId [required]

string