Data Encryption (SSE)
Buckit Server-Side Encryption (SSE) protects objects as part of write operations, allowing clients to take advantage of server processing power to secure objects at the storage layer (encryption-at-rest). SSE also provides key functionality to regulatory and compliance requirements around secure locking and erasure.
Buckit SSE uses the Buckit Key Encryption Service (KES) and an external Key Management Service (KMS) for performing secured cryptographic operations at scale. Buckit also supports client-managed key management, where the application takes full responsibility for creating and managing encryption keys for use with Buckit SSE.
Buckit supports the following KMS as the central key store:
Buckit SSE requires enabling Network Encryption (TLS).
Supported Encryption Types
Buckit SSE is feature and API compatible with AWS Server-Side Encryption and supports the following encryption strategies:
Buckit supports enabling automatic SSE-KMS encryption of all objects written to a bucket using a specific External Key (EK) stored on the external KMS. Clients can override the bucket-default EK by specifying an explicit key as part of the write operation.
For buckets without automatic SSE-KMS encryption, clients can specify an EK as part of the write operation instead.
Buckit encrypts backend data as part of enabling server-side encryption. You cannot disable SSE-KMS encryption once enabled.
SSE-KMS provides more granular and customizable encryption compared to SSE-S3 and SSE-C and is recommended over the other supported encryption methods.
For a tutorial on enabling SSE-KMS in a local (non-production) Buckit Deployment, see Quickstart.
Buckit supports enabling automatic SSE-S3 encryption of all objects written to a bucket using an EK stored on the external KMS. Buckit SSE-S3 supports one EK for the entire deployment.
For buckets without automatic SSE-S3 encryption, clients can request SSE encryption as part of the write operation instead.
Buckit encrypts backend data as part of enabling server-side encryption. You cannot disable SSE-KMS encryption once enabled.
For a tutorial on enabling SSE-s3 in a local (non-production) Buckit Deployment, see Quickstart.
Clients specify an EK as part of the write operation for an object. Buckit uses the specified EK to perform SSE-S3.
SSE-C does not support bucket-default encryption settings and requires clients perform all key management operations.
