Bucket encryption

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To get started, obtain an IAM token for your service account and save it to a file.

1. In the configuration file, describe the parameters of the resources you want to create:

   provider "yandex" {
     cloud_id                 = "<cloud_ID>"
     folder_id                = "<folder_ID>"
     zone                     = "ru-central1-a"
     service_account_key_file = "key.json"
     }
   
   resource "yandex_iam_service_account" "sa" {
     name = "<service_account_name>"
   }
   
   // Assigning a role to a service account
   resource "yandex_resourcemanager_folder_iam_member" "sa-admin" {
     folder_id = "<folder_ID>"
     role      = "storage.admin"
     member    = "serviceAccount:${yandex_iam_service_account.sa.id}"
   }
   
   // Creating a static access key
   resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
     service_account_id = yandex_iam_service_account.sa.id
     description        = "static access key for object storage"
   }
   
   resource "yandex_kms_symmetric_key" "key-a" {
     name              = "<key_name>"
     description       = "<key_description>"
     default_algorithm = "AES_128"
     rotation_period   = "8760h" // 1 year
   }
   
   resource "yandex_storage_bucket" "test" {
     bucket     = "<bucket_name>"
     access_key = yandex_iam_service_account_static_access_key.sa-static-key.access_key
     secret_key = yandex_iam_service_account_static_access_key.sa-static-key.secret_key
     server_side_encryption_configuration {
       rule {
         apply_server_side_encryption_by_default {
           kms_master_key_id = yandex_kms_symmetric_key.key-a.id
           sse_algorithm     = "aws:kms"
         }
       }
     }
   }
   

   Where:

   • service_account_key_file: Path to file with your service account's IAM token (or the file contents).
   • default_algorithm: Encryption algorithm to be used with a new key version. A new version, generated at the next key rotation. The default value is AES_128.
   • rotation_period: Rotation period. To disable automatic rotation, omit this parameter.
   • apply_server_side_encryption_by_default: Default encryption settings on the server side:
     • kms_master_key_id: ID of the KMS master key used for encryption.
     • sse_algorithm: Encryption algorithm used on the server side. The only supported value is aws:kms.

2. Make sure the configuration files are correct.

   1. In the command line, go to the folder where you created the configuration file.
   2. Run a check using this command:

      terraform plan
      

   If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out.

3. Deploy cloud resources.

   1. If the configuration does not contain any errors, run this command:

   terraform apply
   

   1. Confirm that you want to create the resources.

   All the resources you need will then be created in the specified folder. You can check the new resources and their configuration using the management console.

Terraform allows you to quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. Configuration files store the infrastructure description in the HashiCorp Configuration Language (HCL). Terraform and its providers are distributed under the Business Source License.

For more information about the provider resources, see the documentation on the Terraform website or the mirror.

If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To disable encryption for a bucket created using Terraform:

1. Open the Terraform configuration file and delete the server_side_encryption_configuration section from the bucket description.

   Example bucket description in a Terraform configuration

   ...
   resource "yandex_storage_bucket" "test" {
     bucket     = "my-bucket"
     access_key = "123JE02jKxusn********"
     secret_key = "ExamP1eSecReTKeykdo********"
     server_side_encryption_configuration { // Delete this section to disable encryption
       rule {
         apply_server_side_encryption_by_default {
           kms_master_key_id = "abjbeb2bgg4l********"
           sse_algorithm     = "aws:kms"
         }
       }
     }
   }
   ...
   

2. In the command line, go to the directory with the Terraform configuration file.

3. Check the configuration using this command:

   terraform validate
   

   If the configuration is correct, you will get this message:

   Success! The configuration is valid.
   

4. Run this command:

   terraform plan
   

   The terminal will display a list of resources with parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.

5. Apply the configuration changes:

   terraform apply
   

6. Confirm the changes: type yes into the terminal and press Enter.

   You can check the changes in the management console.