Product
Overview
What is AIStor?
Features
Replication Replication Console Console Cache Cache Encryption Encryption Versioning Versioning Observability Observability Object Immutability Object Immutability Key Management Server Key Management Server S3 Compatibility S3 Compatibility Identity + Access Mgt Identity + Access Mgt Catalog Catalog Object Prompt Object Prompt Lifecycle Lifecycle Firewall Firewall AIHub AIHub
Tools
Erasure Code Calculator Erasure Code Calculator Determine your raw and usable capacity across a range of erasure coding settings. Reference Hardware Reference Hardware MinIO’s recommended Configuration and reference hardware for building large scale data infrastructure.
Solutions
AI Storage Learn how MinIO is leading the AI storage market from its exclusive features to performance at scale. HDFS Migration Modernize and simplify your big data storage infrastructure with cloud native storage with AIStor. Snowflake Learn how to leverage Snowflake external tables to query data without having to move it.
Integrations Integrations with MinIO Browse our expansive list of
integrations with links to the relevant
documentation.
Veeam Learn how MinIO and Veeam have partnered deliver superior RTO and RPO. Modern Datalakes Learn how modern, multi-engine data lakeshouses depend on MinIO's AIStor. Equinix Repatriate your data onto the cloud you control with MinIO and Equinix. SQL Server Learn how to leverage SQL Server 2022 with MinIO to run queries on your data without having to move it. Commvault Learn how Commvault and MinIO are partnered to deliver performance at scale for mission critical backup and restore workloads. Hybrid Cloud Learn how enterprises use MinIO to build AI data infrastructure that runs on any cloud - public, private or colo. Splunk Find out how MinIO is delivering performance at scale for Splunk SmartStores. VMware Discover how MinIO integrates with VMware across the portfolio from the Persistent Data platform to TKG and how we support their Kubernetes ambitions.
Open Source
Github Community Explore, experiment, ask questions and contribute. Docs Development guides. Slack Channel Open Forum for discussing topics related to MinIO.
Download MinIO Object Store Get MinIO's open source server, client, and SDK.
Resources
Resources Home Browse our library of white papers, solution briefs, benchmarks and videos. Blog Product updates, company news, and educational content. Training Learn the MinIO Way and Become a Data Infrastructure Expert.
Events Join us to take advantage to meet with MinIO partners, employees, and subject-matter experts.
Partner Pricing Login Download

Documentation

MinIO Object Storage for Linux

mc encrypt set

Syntax

The mc encrypt set encrypt command sets or updates the default bucket Server-Side Encryption (SSE) mode. MinIO automatically encrypts objects written to that bucket using the specified SSE mode.

mc encrypt set only supports SSE-KMS and SSE-S3.

The following command sets the default SSE-KMS encryption key for the bucket mydata on the myminio MinIO deployment:

mc encrypt set sse-kms "minio-encryption-key" myminio/mydata

The command has the following syntax:

mc [GLOBALFLAGS] encrypt set  ENCRYPTION [KMSKEY] ALIAS

  • Brackets [] indicate optional parameters.

  • Parameters sharing a line are mutually dependent.

  • Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Parameters

ENCRYPTION

Specify the server-side encryption type to use as the default SSE mode. Supports the following values:

  • sse-kms - Encrypt objects using the key specified in KMSKEY. MinIO must have access to the specified key on the external KMS to successfully encrypt or decrypt objects protected using SSE-KMS.

  • sse-s3 - Encrypt objects using the key specified to MINIO_KMS_KES_KEY_NAME. MinIO must have access to the specified key on the external KMS to successfully encrypt or decrypt objects protected using SSE-S3.

KMSKEY

Specify the KMS Master Key to use for performing SSE object encryption. This option only applies if ENCRYPTION is sse-kms.

Omit this option to direct MinIO to use the MINIO_KMS_KES_KEY_NAME.

ALIAS

The full path to the bucket on which to set the default SSE mode. Specify the alias of the MinIO deployment as the prefix to the TARGET path. For example:

mc encrypt set ENCRYPTION [KMSKEY] play/mybucket

Global Flags

This command supports any of the global flags.

Examples

Enable Automatic Server-Side Bucket Encryption

The following commands assumes that:

  • The MinIO server configuration supports SSE-KMS

  • The root has an encryption key minio-encryption-key.

 mc encrypt set sse-kms minio-encryption-key myminio/data

mc encrypt set ENCRYPTION KMSKEY TARGET

  • Replace ENCRYPTION with sse-kms or sse-s3 depending on the preferred encryption mode.

  • Replace KMSKEY with the name of the encryption key on the configured root KMS. This argument has no effect with sse-s3.

  • Replace TARGET with the alias of the MinIO deployment on which to configure automatic server-side bucket encryption.

Behavior

mc encrypt set makes no assumptions about the MinIO server’s current encryption state. Specifying default encryption settings which the server cannot support may result in undesired behavior.

Setting or modifying the default server-side encryption settings does not automatically encrypt or decrypt the existing bucket contents. If the bucket contents must have consistent encryption, use the mc mv command with --enc-kms, --enc-s3, or --enc-c to specify the type of encryption to use for the moved contents. This manually modifies the encryption settings or encrypted state of the bucket contents before changing the bucket default.

This work is licensed under a Creative Commons Attribution 4.0 International License. 2020-Present, MinIO, Inc. Creative Commons License