Object Storage Encryption Is Now Available on ZCP

Optional server-side encryption is now available for ZCP object storage in YUL and YOW. Choose SSE-S3 or ZSoftly-managed SSE-KMS, then set a bucket default to encrypt new uploads at rest. Enable it on a new or existing bucket when you are ready.

Two encryption options

• SSE-S3 (AES256) provides service-managed AES-256 encryption.
• SSE-KMS (aws:kms) uses ZSoftly-managed encryption keys. The aws:kms value is the S3 protocol identifier for SSE-KMS. ZSoftly operates the key service for this offering.

The service encrypts objects before storing them and decrypts them for authorized downloads. Your S3 access key and secret authenticate requests. They are separate from the encryption keys. Encryption at rest complements bucket permissions and HTTPS.

Start with a bucket default

Set the default encryption mode before uploading. New objects inherit the bucket default without your application adding an encryption header to every request. This is the recommended starting point in both regions. In YOW, a first upload requesting AES256 without a bucket default might fail. Configure the default first, as shown in the tutorial below.

Manage encryption through the S3 API, AWS CLI, or ZCP CLI. The web consoles do not provide encryption controls. Direct S3 access uses the bucket endpoint and S3 credentials, regardless of which console created the bucket. ZCP CLI requires a service registered in the ZCP console.

We verified both bucket-default modes through AWS CLI in both regions, and ZCP CLI v1.3.0 in YUL. Checks covered encryption metadata and downloads matching the original bytes.

Plan separately for existing objects

Enabling a bucket default does not rewrite existing objects. They retain their previous encryption state. Changing or removing the default also leaves previously stored objects unchanged.

To encrypt data already stored, plan a separate re-upload or rewrite and verify the result. For encrypted server-side copies, use multipart copy and verify the result. Single-request CopyObject has limitations on this platform.

Enable encryption and verify it

Follow the object storage encryption tutorial to configure credentials, set a bucket default, and verify an upload and download with either mode. For command details, see the S3 encryption reference and ZCP CLI encryption reference. Start with a small test object before changing a workload or rewriting an existing dataset.