The put_bucket_encryption interface sets server-side encryption for a bucket. This article explains how to configure SSE-KMS or SSE-TOS encryption rules for a bucket using the Rust SDK’s put_bucket_encryption interface.

Notes

You need to fill in the region and access domain in the sample code according to your actual situation. For details, see Region and Access Domain.

To prevent key leakage, the sample code reads the Access Key ID and Secret Access Key from environment variables. Therefore, before using the SDK, you need to configure long-term access credentials. For details, see Configure Long-Term Access Credentials.

Calling put_bucket_encryption must use the HTTPS protocol.

Permissions required

The Volcano Engine root account has all permissions by default, but IAM users have no permissions by default. If you need to perform put_bucket_encryption operations using a sub-account, the Volcano Engine root account must grant the following permissions to the sub-account through IAM policies and bucket policies:

tos:PutBucketEncryption

Code example

Set SSE-KMS encryption for the specified bucket

use async_trait::async_trait;​
use futures_core::future::BoxFuture;​
use std::env;​
use std::future::Future;​
use std::time::Duration;​
use tokio::runtime::Handle;​
use ve_tos_rust_sdk::common::init_tracing_log;​
use ve_tos_rust_sdk::asynchronous::bucket::BucketAPI;​
use ve_tos_rust_sdk::asynchronous::tos;​
use ve_tos_rust_sdk::asynchronous::tos::AsyncRuntime;​
use ve_tos_rust_sdk::bucket::{PutBucketEncryptionInput, BucketEncryptionRule, ApplyServerSideEncryptionByDefault};​
use ve_tos_rust_sdk::error::TosError;​
​
#[derive(Debug, Default)]​
pub struct TokioRuntime {}​
​
#[async_trait]​
impl AsyncRuntime for TokioRuntime {​
    type JoinError = tokio::task::JoinError;​
    async fn sleep(&self, duration: Duration) {​
        tokio::time::sleep(duration).await;​
    }​
​
    fn spawn<'a, F>(&self, future: F) -> BoxFuture<'a, Result<F::Output, Self::JoinError>>​
    where​
        F: Future + Send + 'static,​
        F::Output: Send + 'static,​
    {​
        Box::pin(Handle::current().spawn(future))​
    }​
​
    fn block_on<F: Future>(&self, future: F) -> F::Output {​
        Handle::current().block_on(future)​
    }​
}​
​
#[tokio::main]​
async fn main() {​
    let _guard = init_tracing_log("info", "temp/logs", "app.log");​
    let ak = env::var("TOS_ACCESS_KEY").unwrap_or("".to_string());​
    let sk = env::var("TOS_SECRET_KEY").unwrap_or("".to_string());​
    let endpoint = "https://tos-cn-beijing.volces.com";​
    let region = "cn-beijing";​
    let client = tos::builder::<TokioRuntime>()​
        .connection_timeout(3000)​
        .request_timeout(10000)​
        .max_retry_count(3)​
        .ak(ak)​
        .sk(sk)​
        .region(region)​
        .endpoint(endpoint)​
        .build().unwrap();​
​
    let bucket_name = "example-bucket";​
    let kms_key_id = "trn:*";​
    let apply_default = ApplyServerSideEncryptionByDefault::new("kms", kms_key_id);​
    let encryption_rule = BucketEncryptionRule::new(apply_default);​
    let input = PutBucketEncryptionInput::new(bucket_name, encryption_rule);​
​
    let result = client.put_bucket_encryption(&input).await;​
    match result {​
        Ok(output) => {​
            println!("Successfully set SSE-KMS encryption for bucket: {}", bucket_name);​
            println!("Request ID: {}", output.request_id());​
        }​
        Err(err) => {​
            match err {​
                TosError::TosClientError { message, .. } => println!("Client error: {}", message),​
                TosError::TosServerError { request_id, ec, code, .. } => println!("Server error: Request ID: {}, EC: {}, Code: {}", request_id, ec, code),​
                _ => println!("Unexpected error: {:?}", err)​
            }​
        }​
    }​
}​