Oracle Cloud Infrastructure Documentation

Re-encrypting an Object Storage Bucket's Data Encryption Keys

Re-encrypt the unique data encryption key that encrypts each object written to an Object Storagebucket by using the most recent version of the master encryption key.

See Object Storage Data Encryption for more information.

Encrypting the Bucket Key Only and Skipping the Re-Encryption of the Object Data Encryption Key

Use the option to only re-encrypt the bucket key when the bucket key is already enabled for the bucket. This option re-encrypts the bucket key for the bucket and skips re-encrypting the data encryption keys for objects. To migrate existing objects to the bucket key wrapping after enabling bucket key, run the bucket re-encryption without this option.

    1. On the Buckets list page, select the Object Storage bucket that you want to work with. If you need help finding the list page or the bucket, see Listing Buckets.
      The Buckets list page opens. All buckets in the selected compartment are displayed in a table.
    2. From the Actions menu, select Re-encrypt.
      1. Select Re-encrypt bucket keys for buckets using bucket level keys
      2. Select Re-encrypt bucket keys and objects for buckets using both bucket and object level encryption

  • Use the oci os bucket reencrypt command and required parameters to re-encrypt the unique data encryption key that encrypts each object written to the bucket by using the most recent version of the master encryption key assigned to the bucket.

    oci os bucket reencrypt --bucket-name bucket_name --is-reencrypt-bucket-key-only true

    For example:

    $ oci os bucket reencrypt --bucket-name MyBucket --namespace-name namespace --is-reencrypt-bucket-key-only true 
{
  "opc-work-request-id": "69ce08dd-c3d0-4351-9a0a-5a2dde227464"
}

    For a complete list of parameters and values for CLI commands, see the CLI Command Reference.

  • Run the ReencryptBucket operation to re-encrypt the unique data encryption key that encrypts each object written to the bucket by using the most recent version of the master encryption key assigned to the bucket.

    When accessing the Object Storage API, the bucket name is used with the Object Storage namespace name to form the request URL:

    n/object_storage_namespace/b/bucket