Default Encryption for a Bucket

You can configure default encryption for an OBS bucket. Once configured, any objects you upload to the bucket will be encrypted with the specified KMS key by default.

You can enable default encryption when creating a bucket (see Creating a Bucket). You can also enable or disable default encryption for an existing bucket.

OBS only encrypts the objects uploaded after default encryption is enabled for the bucket, and does not encrypt those uploaded before. After default encryption is disabled, encryption status of existing objects in the bucket remains unchanged, and you can still encrypt objects when you upload them.

Enabling Default Encryption for a Bucket

In the bucket list of OBS Console, click the required bucket to go to the Overview page.
In the Basic Configurations area, click Default Encryption. The Default Encryption dialog box is displayed.
Select Enable.

Key obs/default is selected by default for KMS encryption. You can also click Create KMS Key to create one on the DEW console. Then, go back here and select the created key from the drop-down list.
Click OK.

Disabling Default Encryption for a Bucket

In the bucket list of OBS Console, click the required bucket to go to the Overview page.
In the Basic Configurations area, click Default Encryption. The Default Encryption dialog box is displayed.
Select Disable.
Click OK.