Encrypt objects with your own key

E2E Managed Encryption, the checkbox on a bucket’s creation form, is the simplest way to encrypt a bucket: E2E generates and manages the key for you. If you would rather hold the key yourself, encrypt individual objects with your own key instead, through the mc client. You need mc set up first; see Connect with the mc client.

You are responsible for the key once you generate it: E2E never stores it, and if you lose it, the object it encrypted is permanently unreadable.

Generate a key

openssl rand -hex 32

This prints a 256-bit key as 64 hexadecimal characters, one of the two formats mc accepts. Save the output somewhere safe; you will need the exact same key every time you read this object back.

Upload an object with your key

mc cp <local-file> <alias-name>/<bucket-name>/<object-name> \
  --enc-c "<alias-name>/<bucket-name>/=<your-key>"

Replace <your-key> with the 64 characters you generated. The part before the = says which objects the key is for; <alias-name>/<bucket-name>/ covers every object in that bucket. On an mc release from before mid-2024, the same option is named --encrypt-key.

Confirm it uploaded encrypted:

mc stat <alias-name>/<bucket-name>/<object-name> \
  --enc-c "<alias-name>/<bucket-name>/=<your-key>"

mc stat needs the same key to read the object’s details. With the right key, it prints the object’s name, size, and date; without it, or with a different key, the command fails. That failure is itself the sign that the object is encrypted with your key.

Copy an encrypted object elsewhere

mc cp <source-alias>/<source-bucket>/<object> <destination-alias>/<destination-bucket>/<object> \
  --enc-c "<source-alias>/<source-bucket>/=<your-key>" \
  --enc-c "<destination-alias>/<destination-bucket>/=<your-key>"

The first key reads the object from the source; the second encrypts the copy at the destination. They can be the same key or two different ones.

To download the object again later, pass the same key to mc cp or mc cat:

mc cp <alias-name>/<bucket-name>/<object-name> <local-file> \
  --enc-c "<alias-name>/<bucket-name>/=<your-key>"

What to keep track of

You are the only record of which key encrypted which object: keep your own mapping of key to object, and to object version if the bucket has Object Versioning on, since each version can carry a different key. Every read of an object encrypted this way has to send its key, so a download or a presigned URL from the dashboard, which cannot send it, does not open the object; use mc with the same key instead. You can delete such an object without knowing its key. You can also encrypt an individual object with your own key during upload even on a bucket that has E2E Managed Encryption on, overriding it for that one object.

An object encrypted with your own key is not compatible with bucket replication: set up replication before encrypting objects this way, or keep encrypted objects out of a bucket you plan to replicate.

Keep the key wherever you keep your other secrets, such as a password manager or your team’s secrets store.