Server Side Encryption with KES

This page explains how to deploy MinIO AIStor with KES for Server Side Encryption. For instructions on running KES, see the KES docs.

Broadly, the required steps are:

  1. Create a new external key (EK) for server-side encryption (SSE).

  2. Create or modify an MinIO AIStor deployment to support SSE with KES.

  3. Configure automatic bucket-default SSE.

Enabling SSE on an MinIO AIStor deployment automatically encrypts the backend data for that deployment using the default encryption key.

MinIO AIStor requires access to KES and the external KMS to decrypt the backend and start normally. The KMS must maintain access to the MINIO_KMS_KES_KEY_NAME. Once enabled, you cannot disable or reset encryption of the backend.

Prerequisites

Procedure

  1. Generate a KES API key for MinIO AIStor

    Run the kes identity new command to generate a new API key:

    kes identity new

    The output includes both the API key for MinIO AIStor and the identity hash for the KES Policy configuration.

  2. Edit the MinIO AIStor environment file

    Create or modify the environment file for all hosts in the target deployment to include the following environment variables:

    # Add these environment variables to the existing environment file

MINIO_KMS_KES_ENDPOINT=https://HOSTNAME:7373
MINIO_KMS_KES_API_KEY="kes:v1:ACTpAsNoaGf2Ow9o5gU8OmcaG6Af/VcZ1Mt7ysuKoBjv"

# Allows validation of the KES Server Certificate (Self-Signed or Third-Party CA)
# Change this path to the location of the KES CA Path
MINIO_KMS_KES_CAPATH=/opt/kes/certs/kes-server.cert

# Sets the default KMS key for the backend and SSE-KMS/SSE-S3 Operations)
MINIO_KMS_KES_KEY_NAME=minio-backend-default-key

    Replace HOSTNAME with the IP address or hostname of the KES server. If the MinIO AIStor host machines cannot resolve or reach the specified HOSTNAME, the deployment may return errors or fail to start.

    • If using a single KES server host, specify the IP or hostname of the host
    • If using multiple KES server hosts, specify a comma-separated list of IPs or hostnames of each host

    MinIO AIStor uses the MINIO_KMS_KES_KEY_NAME key for the following cryptographic operations:

    • Encrypting the MinIO AIStor backend (IAM, configuration, etc.)

    • Encrypting objects using SSE-KMS if the request does not include a specific key.

    • Encrypting objects using SSE-S3.

    MinIO AIStor defaults to expecting this file at /etc/default/minio. If you modified your deployment to use a different location for the environment file, modify the file at that location.

  3. Start MinIO AIStor

    You can use the mc admin service restart command to restart MinIO AIStor:

    mc admin service restart ALIAS

  4. Generate a New Encryption Key

    MinIO AIStor requires that the key exist on the KMS before performing operations with the key.

    Run kes key create or mc admin kms key create to add a new key.

    The following command runs mc admin kms key create to add a new External Key (EK) stored on the KMS server for use with encrypting the MinIO AIStor backend.

    mc admin kms key create ALIAS KEYNAME

  5. Enable SSE-KMS for a Bucket

    You can use either the console or the AIStor Client CLI to enable bucket-default SSE-KMS with the generated key: