Description

Ensure every Object Storage bucket has server-side encryption with OVHcloud-managed keys (SSE-OMK) enabled as its default encryption, so all new objects are encrypted at rest automatically.

Rationale

Without default encryption, objects are stored unencrypted unless each upload asks for encryption. SSE-OMK encrypts every new object transparently with keys managed by OVHcloud, protecting data at rest with no changes to applications.

Impact

  • New objects are encrypted at rest automatically

  • No changes needed in applications

  • Objects uploaded before enabling it are not encrypted

Default Value

By default, bucket encryption is not enabled unless it is chosen at creation.

Pre-Requisites

  • Permission to manage Object Storage in the Public Cloud project

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Object Storage.

  4. Select the bucket and check the Encryption Default field in the information panel.

  5. Alternatively, run: aws s3api get-bucket-encryption --bucket <bucket_name> --endpoint-url https://s3.<region>.io.cloud.ovh.net

  6. If encryption is not enabled, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Object Storage.

  4. Select the bucket and, in the information panel, click Enable encryption.

  5. Click Enable to confirm.

  6. To encrypt objects uploaded earlier, copy them again so they are rewritten with encryption.

Backout Plan

  1. Run: aws s3api delete-bucket-encryption --bucket <bucket_name> --endpoint-url https://s3.<region>.io.cloud.ovh.net

Reference