Encryption
Objects sealed under the server's key, a named key or the customer's own; keys kept in a vault of their own and rotated without touching object bytes.
Every object can be stored sealed. The data is encrypted in blocks under a data key of its own, and that data key is wrapped by a key the server holds or by the key the customer sends.
Three ways to seal
| Request | Sealed under | Notes |
|---|---|---|
x-amz-server-side-encryption: AES256 | the server's key | SSE-S3 |
x-amz-server-side-encryption: aws:kms with a key id | a named key this node holds | an unknown key is refused |
x-amz-server-side-encryption-customer-* | the customer's key | SSE-C: over TLS only; the key is never stored |
Sealing applies to PutObject, CopyObject, multipart uploads and part copies. GetObject and HeadObject open what was sealed. Replicas and erasure shards stay sealed.
A version sealed with a customer key is not replicated, gets no renditions and cannot be downloaded through the console, because none of those holds the key.
Bucket default
PutBucketEncryption sets what a write that asks for nothing gets: AES256, or
aws:kms with a key id. A request's own header wins. Customer keys are refused in a
bucket unless its BlockedEncryptionTypes is NONE. The console sets the same thing
from a bucket's row.
The keys vault
The server's keys live in a vault of their own in the metadata store, sealed under a
passphrase of at least 15 characters. Until it is opened, a request that needs one
of its keys is answered 503 ServiceUnavailable.
TESSARIDB_S3_KEYS_PASSPHRASEopens it at start, or- an operator unseals it in the console (Overview → Encryption keys).
Opened keys live only in the process's memory.
Rotating and destroying
Rotating the server key in the console makes a new key current. Every data key is then re-wrapped under it in the background; the object bytes are never rewritten. Each older key shows how many data keys it still wraps, and it can be destroyed once that count is zero.
Serving over TLS
TESSARIDB_S3_TLS_CERT and _KEY serve the S3 API over TLS 1.2 and 1.3. Customer
keys need it.