Set server-side encryption
Overview
To further enhance data security, BOS supports SSE (Server-Side Encryption) to encrypt data on the server side. When you configure SSE settings, BOS applies encryption during the upload process using the specified encryption parameters. Additionally, BOS offers a server-side encryption (SSE) toggle in bucket settings to improve usability. Once enabled, newly uploaded data will be encrypted by default, without affecting data uploaded prior to enabling these settings.
Encryption method
Currently, BOS supports two encryption methods: BOS managed keys and KMS service managed keys
- BOS-managed keys: Choosing this option enables unified encryption for all data uploaded to a bucket using BOS-managed keys. When retrieving data, the system automatically decrypts it, requiring no user intervention for a seamless experience.
- KMS service managed keys: You need to activate Baidu AI Cloud Key Management Service and create self-managed KMS keys. KMS will generate the corresponding Data Keys based on your created KMS master key. Data is automatically encrypted during upload using these Data Keys.
Set server-side encryption
- Sign in to the Baidu AI Cloud Object Storage (BOS) Management Console.
- From the bucket list on the left, select the bucket for which you want to set permissions, then click its name to enter the bucket management directory.
- Select the Configuration Management tab in the top navigation bar.
- On the Configuration Management page, select Advanced Configuration, and click Modify Configuration in the Server-Side Encryption Configuration area to configure server-side encryption for the bucket.

-
In the server-side encryption settings bar, enable encryption and choose your encryption method. You can select BOS managed keys or KMS managed keys to perform server-side encryption on the uploaded data.
- If you choose BOS managed keys, no additional configuration is necessary. Simply click OK to activate.
- If you select KMS managed keys for encryption, you need to activate Baidu AI Cloud Key Management Service and create self-managed KMS keys. When selecting KMS service managed key method, choose the created key from the dropdown list in Baidu AI Cloud KMS Key Management Service. Thereafter, data uploaded to this bucket will be encrypted with the custom key selected by users. Similarly, when a user reads data, the BOS service requests data decryption from the KMS service before returning plaintext data to the user.

- Click OK to complete the server-side encryption configuration.
Related APIs
- PutBucketEncryption API: Use the PutBucketEncryption API to enable the encryption switch for the specified bucket.
- GetBucketEncryption API: Use the GetBucketEncryption API to check whether server-side encryption for the bucket is enabled.
- DeleteBucketEncryption API: Use the DeleteBucketEncryption API to disable the server-side encryption function.
