Bucket encryption

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

Before you start, get an IAM token for your service account and save it to a file.

1. In the configuration file, describe the resources you want to create:

   provider "yandex" {
     cloud_id                 = "<cloud_ID>"
     folder_id                = "<folder_ID>"
     zone                     = "ru-central1-a"
     service_account_key_file = "key.json"
   }
   
   resource "yandex_iam_service_account" "sa" {
     name = "<service_account_name>"
   }
   
   // Assigning a role to a service account
   resource "yandex_resourcemanager_folder_iam_member" "sa-admin" {
     folder_id = "<folder_ID>"
     role      = "storage.admin"
     member    = "serviceAccount:${yandex_iam_service_account.sa.id}"
   }
   
   // Creating a static access key
   resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
     service_account_id = yandex_iam_service_account.sa.id
     description        = "static access key for object storage"
   }
   
   resource "yandex_kms_symmetric_key" "key-a" {
     name              = "<key_name>"
     description       = "<key_description>"
     default_algorithm = "AES_128"
     rotation_period   = "8760h" // 1 year
   }
   
   resource "yandex_storage_bucket" "test" {
     bucket     = "<bucket_name>"
     access_key = yandex_iam_service_account_static_access_key.sa-static-key.access_key
     secret_key = yandex_iam_service_account_static_access_key.sa-static-key.secret_key
     server_side_encryption_configuration {
       rule {
         apply_server_side_encryption_by_default {
           kms_master_key_id = yandex_kms_symmetric_key.key-a.id
           sse_algorithm     = "aws:kms"
         }
       }
     }
   }
   

   Where:

   • service_account_key_file: Path to the file with your service account's IAM token (or the file contents).
   • default_algorithm: Encryption algorithm to use with a new key version. A new version of the key is generated with each key rotation. The default value is AES_128.
   • rotation_period: Rotation period. To disable automatic rotation, skip this parameter.
   • apply_server_side_encryption_by_default: Default encryption settings on the server side:
     • kms_master_key_id: ID of the KMS master key used for encryption.
     • sse_algorithm: Encryption algorithm used on the server side. The only supported value is aws:kms.

   For more information about the yandex_storage_bucket properties in Terraform, see this provider guide.

2. Apply the changes:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   You can check the update using the management console.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the relevant documentation on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To remove encryption for a bucket created using Terraform:

1. Open the Terraform configuration file and delete the server_side_encryption_configuration section from the bucket description.

   Example of a bucket description in Terraform configuration

   ...
   resource "yandex_storage_bucket" "test" {
     bucket     = "my-bucket"
     access_key = "123JE02jKxusn********"
     secret_key = "ExamP1eSecReTKeykdo********"
     server_side_encryption_configuration { // Delete this section to disable encryption
       rule {
         apply_server_side_encryption_by_default {
           kms_master_key_id = "abjbeb2bgg4l********"
           sse_algorithm     = "aws:kms"
         }
       }
     }
   }
   ...
   

2. Apply the changes:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   You can check the update using the management console.