Bucket encryption

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

Before you start, get an IAM token for your service account and save it to a file.

1. In the configuration file, describe the properties of resources you want to create:

   provider "yandex" {
     cloud_id                 = "<cloud_ID>"
     folder_id                = "<folder_ID>"
     zone                     = "ru-central1-a"
     service_account_key_file = "key.json"
   }
   
   resource "yandex_iam_service_account" "sa" {
     name = "<service_account_name>"
   }
   
   // Assigning a role to a service account
   resource "yandex_resourcemanager_folder_iam_member" "sa-admin" {
     folder_id = "<folder_ID>"
     role      = "storage.admin"
     member    = "serviceAccount:${yandex_iam_service_account.sa.id}"
   }
   
   // Creating a static access key
   resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
     service_account_id = yandex_iam_service_account.sa.id
     description        = "static access key for object storage"
   }
   
   resource "yandex_kms_symmetric_key" "key-a" {
     name              = "<key_name>"
     description       = "<key_description>"
     default_algorithm = "AES_128"
     rotation_period   = "8760h" // 1 year
   }
   
   resource "yandex_storage_bucket" "test" {
     bucket     = "<bucket_name>"
     access_key = yandex_iam_service_account_static_access_key.sa-static-key.access_key
     secret_key = yandex_iam_service_account_static_access_key.sa-static-key.secret_key
     server_side_encryption_configuration {
       rule {
         apply_server_side_encryption_by_default {
           kms_master_key_id = yandex_kms_symmetric_key.key-a.id
           sse_algorithm     = "aws:kms"
         }
       }
     }
   }
   

   Where:

   • service_account_key_file: Path to the file with your service account's IAM token (or the file contents).
   • default_algorithm: Encryption algorithm to use with a new key version. A new version of the key is generated with each key rotation. The default value is AES_128.
   • rotation_period: Rotation period. To disable automatic rotation, skip this parameter.
   • apply_server_side_encryption_by_default: Default encryption settings on the server side:
     • kms_master_key_id: ID of the KMS master key used for encryption.
     • sse_algorithm: Encryption algorithm used on the server side. The only supported value is aws:kms.

2. Make sure the configuration files are correct.

   1. In the command line, navigate to the directory where you created the configuration file.
   2. Run a check using this command:

      terraform plan
      

   If the configuration description is correct, the terminal will display a list of the resources being created and their settings. If the configuration contains any errors, Terraform will point them out.

3. Deploy the cloud resources.

   1. If the configuration does not contain any errors, run this command:

   terraform apply
   

   1. Confirm creating the resources.

   This will create all the resources you need in the specified folder. You can check the new resources and their configuration using the management console.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the relevant documentation on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To remove encryption for a bucket created using Terraform:

1. Open the Terraform configuration file and delete the server_side_encryption_configuration section from the bucket description.

   Example of a bucket description in Terraform configuration

   ...
   resource "yandex_storage_bucket" "test" {
     bucket     = "my-bucket"
     access_key = "123JE02jKxusn********"
     secret_key = "ExamP1eSecReTKeykdo********"
     server_side_encryption_configuration { // Delete this section to disable encryption
       rule {
         apply_server_side_encryption_by_default {
           kms_master_key_id = "abjbeb2bgg4l********"
           sse_algorithm     = "aws:kms"
         }
       }
     }
   }
   ...
   

2. In the command line, navigate to the directory with the Terraform configuration file.

3. Check the configuration using this command:

   terraform validate
   

   If the configuration is correct, you will get this message:

   Success! The configuration is valid.
   

4. Run this command:

   terraform plan
   

   You will see a detailed list of resources. No changes will be made at this step. If the configuration contains any errors, Terraform will show them.

5. Apply the changes:

   terraform apply
   

6. Confirm the changes: type yes into the terminal and press Enter.

   You can check the update using the management console.