---
title: "Create an encrypted bucket"
description: "Create a TIR Object Storage bucket in Delhi with E2E Managed or User Managed encryption, and know what each choice means for your keys."
content_type: "how-to"
product: "tir-object-storage"
platform: "TIR"
url: "/tir/tir-object-storage/how-to/create-an-encrypted-bucket/"
topic: ["create-and-connect"]
---

# Create an encrypted bucket

Encrypt the data in a bucket when you create it. You can use a key E2E holds for you or a key you keep yourself. Encryption is set when you create the bucket and stays as you set it.

## Before you begin

- A TIR project in the Delhi region, where encryption is offered.
- Permission to create datasets in the project. A Member gets it through a policy that allows creating datasets.
- A choice between the two types. Use **E2E Managed** unless you must hold the keys yourself.

## Choose the encryption type

**E2E Managed** is the default when you turn encryption on. E2E creates and holds the key and encrypts
and decrypts for you, so uploads, downloads, and mounts work as usual.

**User Managed** puts the key in your hands. You create, rotate, and delete the key yourself and pass
it with every upload and download, and only you hold a copy. If you lose a key, you lose the data
permanently, so have a plan for a lost or damaged key. A bucket encrypted this way
cannot be mounted by other TIR services such as instances.

## Create the bucket

1. Open **Create Object Storage** as described in
   [Create a bucket](/tir/tir-object-storage/how-to/create-a-bucket/), and fill in **Bucket Name**
   and the other fields.
2. Turn **Enable Encryption** on, and choose the **Encryption Type**: **E2E Managed** or **User
   Managed**.
3. Select **Create**.
4. In **Dataset Encryption**, tick the box that says you understand you cannot change the encryption later, then select
   **Continue**.

If setting up E2E Managed encryption fails, TIR reports "Failed to create encrypted Bucket" and
discards the bucket. Create the bucket again.

## Use a User Managed bucket

On a bucket with **User Managed** encryption, the **Setup** tab has an **Encryption** section with
three sets of commands. One makes a random key with `openssl`, and the other two use the key
with `mc`: `mc cp` uploads a file or folder, and `mc stat` checks a file's encryption. Keep the key in a
safe place, because every upload and download needs it.

## Check the encryption

The new bucket's **Encryption** is **Enabled** in the list, and its **Overview** tab gives the
**Encryption Type**.

Encryption stays on for as long as the bucket exists. To add data,
[upload data to the bucket](/tir/tir-object-storage/how-to/upload-data-to-a-bucket/). For help with
a message, see
[Troubleshooting TIR Object Storage](/tir/tir-object-storage/troubleshooting/tir-object-storage/).