Docs

Torch Object Storage

Server-side encryption

Setting bucket encryption

Once you set the server-side encryption method for a bucket, all objects uploaded to the bucket will automatically inherit its encryption settings, unless otherwise specified. This topic explains how to configure server-side encryption for a bucket.

Notes

Category	Description
Encryption methods	Only objects uploaded after server-side encryption is enabled for the bucket will be encrypted. This feature does not alter the encryption status of objects uploaded prior to its activation. Similarly, modifying the server-side encryption setting for a bucket only applies to objects uploaded after the modification. It does not affect the encryption status of objects uploaded before the change. Only SSE-KMS and SSE-TOS are available for bucket encryption.
Using SSE-KMS	If you are using SSE-KMS for server-side encryption for the first time, you must first activate KMS. Although activating KMS is free, using the service incurs charges. Using SSE-KMS for server-side encryption generates API call fees, and creating KMS keys generates key management fees. These fees are charged by KMS. For more information, see KMS Billing Overview. SSE-KMS only encrypts object data, not metadata. To upload objects with SSE-KMS, you need the kms:GenerateDataKey permission. To download SSE-KMS-encrypted objects, you need the kms:Decrypt permission. SSE-KMS-encrypted objects do not support anonymous access. To access SSE-KMS-encrypted objects, you must activate KMS and have permission to access the master key. Requests must also be signed using valid credentials. Supported regions: AES-256: All regions. For more information, see Regions and endpoints. SM4: China (Beijing), China (Guangzhou), and China (Shanghai) For more information, see Overview.
Using SSE-TOS	Supported regions: AES-256: All regions. For more information, see Regions and endpoints. SM4: China (Beijing), China (Guangzhou), and China (Shanghai) For more information, see Overview.

Enabling server-side encryption when creating a bucket

You can enable server-side encryption when creating a bucket. For instructions, see Creating buckets.

Enabling server-side encryption for an existing bucket

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Security > Server-Side encryption.

On the Server-Side encryption page, click Edit and select a server-side encryption method that best fits your needs.

Server-side encryption	Description
None	No encryption applied.
SSE-TOS	SSE-TOS encrypts objects during upload and decrypts objects during download using TOS-hosted keys. For more information, see Server-side encryption. After selecting SSE-TOS, you must also set encryption algorithm to either AES256 or SM4.
SSE-KMS	SSE-KMS uses keys managed by Volcano Engine Key Management Service (KMS) to encrypt and decrypt objects. For more information, see Server-side encryption. After selecting SSE-KMS, configure the following parameters: Encryption algorithm: Select the encryption algorithm for the key. Options include AES256 and SM4. For more information, see Key Specification. Encryption Key Type: Custom Key is selected by default. Key Project: Select the project to which the custom key belongs. The system will then display the available custom keys under that project. To create a new project, click Create new projects. For more information, see Project management. Custom Key: Select a KMS key. If you have not created a key yet, proceed to the KMS console to do so. For instructions, see Key Management Quick Start.

Click Select.

Related operations

You can also perform the following operations:

Operation	Steps
View the server-side encryption method of a bucket	In the left navigation pane, click Overview. In the Basic Information section, view the server-side encryption method of the bucket. For instructions, see Bucket overview.
Change the server-side encryption method for a bucket	From Overview In the left navigation pane, click Overview. In the Basic information section, click Settings next to Server-Side encryption. On the Server-Side encryption page, click Edit to modify the server-side encryption method. From Security In the left navigation pane, select Security > Server-Side encryption. On the Server-Side encryption page, click Edit to modify the server-side encryption method.
Configure server-side encryption when uploading objects	You can set the server-side encryption method when uploading objects. For instructions, see Uploading objects.

Last updated: 2026.10.22 14:12:38