/// GUIDES / ENCRYPTION (SSE)
Encryption (SSE)
Set the default bucket encryption that protects your objects at rest. Open a Fleet, go to Settings → Encryption, choose a mode, and save. storafleet then applies that default to objects you upload from here on.
What this controls
Encryption at rest scrambles object data on the storage provider's disks so it is unreadable without the key. The mode you can pick depends on the provider behind the Fleet — on AWS you choose between two server-side encryption (SSE) modes, while other providers manage encryption themselves and storafleet simply reports the status.
AWS: SSE-S3 (default)
For an AWS Fleet, the default mode is SSE-S3. Each object is encrypted with AES-256 using keys that Amazon S3 fully manages for you — there is nothing to configure and no key to rotate yourself. Choose this when you want at-rest encryption with zero operational overhead.
- Cipher —
AES-256. - Key management — handled entirely by S3.
- Setup — none; this is what a Fleet uses unless you switch.
AWS: SSE-KMS
Switch an AWS Fleet to SSE-KMS when you want to bring your own key. In Settings → Encryption, pick SSE-KMS and supply the AWS KMS key (the key ID or its ARN). With your own key you stay in control:
- You control rotation — manage the key's rotation policy in AWS KMS.
- You get an audit trail — AWS CloudTrail records every decrypt against the key, so you can see who accessed what and when.
- You can lower KMS cost — enable the optional S3 Bucket Key to reduce the number of KMS requests S3 makes, which lowers KMS request charges.
kms:Decrypt and kms:GenerateDataKey). If the key policy does not allow it, uploads and downloads will fail until access is granted.Other providers
For every non-AWS provider, storafleet does not switch the SSE mode — instead it displays the at-rest encryption status so you know where you stand:
- Cloudflare R2, Backblaze B2, Wasabi, and DigitalOcean Spaces encrypt objects at rest by default.
- MinIO and other custom S3-compatible servers depend on the server's own KMS configuration — at-rest encryption is whatever the operator has set up.
Credentials you store in storafleet
Separate from bucket encryption: the credentials you save in storafleet for a Fleet are themselves encrypted with a per-user AES-256-GCM key. That protects the stored secret material independently of how the bucket encrypts your objects.