Set server-side encryption
Updated at:2025-11-03
Overview
BOS allows users to include the x-bce-server-side-encryption HTTP header in upload and copy requests (such as PutObject, PostObject, InitiateMultipartUpload, AppendObject, FetchObject, CopyObject) to specify the desired encryption algorithm (currently, only AES256 and SM4 are supported), ensuring robust data security.
Operation types
You can set up server-side encryption through the console, SDK, and API as follows:
- Setting server-side encryption via the console: Currently, AES256 and SM4 encryption algorithms are supported. For reference, please see [Setting Up Server-Side Encryption](BOS/Console Operation Guide/Managing Bucket/Set server-side encryption.md).
Setting server-side encryption via SDK: You can set the AES256 and SM4 encryption algorithms:
Setting server-side encryption via API:
Note
- If an object request includes the x-bce-server-side-encryption HTTP header with specified encryption, the file will be encrypted regardless of the bucket encryption switch's status.
- If encryption is not specified in the object request, the file will only be encrypted if the bucket encryption switch is turned on.
- Changes to the bucket encryption switch's status do not affect existing files; they only apply to new files.
