Using SSE with the Object Store¶
The Jetstream 2 Object Store now supports Server-Side Encryption (SSE), allowing users to encrypt data at rest during the upload process. To enable this feature, follow the configuration steps outlined below.
Creating a Secret¶
First, generate a Barbican secret order. Ensure you have sourced your application credentials before executing the following command:
openstack secret order create key --name rgw-encryption-key --algorithm AES --bit-length 256 --mode CBC
Make sure to take note of the secret href, you’ll need to pass the secret UUID to rclone to encrypt the object.
Updating the Secret ACL¶
Once the secret has been created, you’ll need to allow the user 28b5ec3b70ee4aeaba88fe38aa495c5b (rgwcrypt-user) permission to read the secret. You can do that by running the following curl command. Replace $OS_TOKEN with a valid authentication token generated via openstack token issue
curl -X PUT -H 'content-type:application/json' \
-H 'X-Auth-Token: $OS_TOKEN' \
-d '
{
"read":{
"users":[
"28b5ec3b70ee4aeaba88fe38aa495c5b"
],
"project-access":true
}
}' \
https://js2.jetstream-cloud.org:9311/v1/secrets/<Barbican UUID>/acl
Uploading Objects with SSE flags¶
To enable SSE during upload via rclone, include the –s3-server-side-encryption and –s3-sse-kms-key-id flags as shown in the example below:
rclone copy resolute-server-cloudimg-armhf.tar.gz js2-object-store:<Bucket-Name>/resolute-server-cloudimg-armhf.tar.gz --s3-server-side-encryption aws:kms --s3-sse-kms-key-id <Barbican UUID> --config ./rclone.conf
Ensure your rclone.conf is configured correctly. Replace access_key_id and secret_access_key with your generated EC2 credentials.
[js2-object-store]
type = s3
provider = Ceph
access_key_id =
secret_access_key =
endpoint = https://js2.jetstream-cloud.org:8001
acl = private
Verifying Encryption¶
You can verify that an object is encrypted at rest by inspecting the object headers using curl:
curl -I --aws-sigv4 "aws:amz:default:s3" --user "<access_key_id>:<secret_access_key>" https://js2.jetstream-cloud.org:8001/<Bucket Name>/<Object Name>/