Create an encrypted bucket

Encrypt the data in a bucket when you create it. You can use a key E2E holds for you or a key you keep yourself. Encryption is set when you create the bucket and stays as you set it.

Before you begin

• A TIR project in the Delhi region, where encryption is offered.
• Permission to create datasets in the project. A Member gets it through a policy that allows creating datasets.
• A choice between the two types. Use E2E Managed unless you must hold the keys yourself.

Choose the encryption type

E2E Managed is the default when you turn encryption on. E2E creates and holds the key and encrypts and decrypts for you, so uploads, downloads, and mounts work as usual.

User Managed puts the key in your hands. You create, rotate, and delete the key yourself and pass it with every upload and download, and only you hold a copy. If you lose a key, you lose the data permanently, so have a plan for a lost or damaged key. A bucket encrypted this way cannot be mounted by other TIR services such as instances.

Create the bucket

1. Open Create Object Storage as described in Create a bucket, and fill in Bucket Name and the other fields.
2. Turn Enable Encryption on, and choose the Encryption Type: E2E Managed or User Managed.
3. Select Create.
4. In Dataset Encryption, tick the box that says you understand you cannot change the encryption later, then select Continue.

If setting up E2E Managed encryption fails, TIR reports “Failed to create encrypted Bucket” and discards the bucket. Create the bucket again.

Use a User Managed bucket

On a bucket with User Managed encryption, the Setup tab has an Encryption section with three sets of commands. One makes a random key with openssl, and the other two use the key with mc: mc cp uploads a file or folder, and mc stat checks a file’s encryption. Keep the key in a safe place, because every upload and download needs it.

Check the encryption

The new bucket’s Encryption is Enabled in the list, and its Overview tab gives the Encryption Type.

Encryption stays on for as long as the bucket exists. To add data, upload data to the bucket. For help with a message, see Troubleshooting TIR Object Storage.