Using SSE-C to Encrypt Objects

In this key security feature, all data is encrypted before it is stored. This occurs regardless of whether the data is encrypted at the source. This data protection feature can not be disabled. Two options for server-side encryption are supported:

• Server-side encryption with client-provided key (SSE-C)
• Server-side encryption with a key generated by the Lyve Cloud key management system (KMS) (SSE-S3)

This example illustrates how customers can use S3 Server-side encryption with client-provided (SSE-C) encryption keys.

Listing contents of the bucket

Let us first list current objects in the bucket so that any new object added to the bucket can be identified.

Use the following command to list contents of the bucket:

aws s3 ls ak-atempo1 --profile LCDemo --endpoint https://s3.us-east-1.lyvecloud.seagate.com

PRE docs/                         
PRE level1/                         
PRE topleveldir/
2022-12-02 18:12:53  536 allprefixakcopy.json

Creating an object

Create a sample object. When creating a sample object, the object is unencrypted. However, S3 encrypts the object during the upload operation.

echo "Test SSE-C Key" > ssec.txt

Creating a key

Create a key to encrypt the object.

openssl rand 32 -out ssec.key

Uploading the object

Using the following command, the object (ssec.txt )is uploaded to S3. S3 encrypts the object using the provided key (ssec.key).

aws s3 cp ssec.txt s3://ak-atempo1/ssec.txt --sse-c AES256 --sse-c-key fileb://ssec.key  --profile LCDemo --endpoint https://s3.us-east-1.lyvecloud.seagate.com

The following output occurs after the command is executed:

upload: ./ssec.txt to s3://ak-atempo1/ssec.txt

Listing contents of the bucket

Use the following command to list the contents of the bucket. The new object (ssec.txt) that is uploaded is listed,

aws s3 ls ak-atempo1 --profile LCDemo --endpoint https://s3.us-east-1.lyvecloud.seagate.com

PRE docs/
PRE level1/
PRE topleveldir/

2022-12-02 18:12:53    536 allprefixakcopy.json
2023-01-25 16:24:56    15 ssec.txt

Downloading the object

Using the following command, the object ssec.txt is downloaded from S3. S3 decrypts the object using the key ssec.key:

aws s3 cp s3://ak-atempo1/ssec.txt ssec-downloaded.txt --sse-c AES256 --sse-c-key fileb://ssec.key --profile LCDemo --endpoint https://s3.us-east-1.lyvecloud.seagate.com

The following output occurs after the command is executed:

download: s3://ak-atempo1/ssec.txt to ./ssec-downloaded.txt

Contents of the downloaded file

Run the following command to check the content of the object downloaded from S3.

cat ssec-downloaded.txt

Test SSE-C Key