Enabling CSE-KMS
To enable CSE-KMS, the property
fs.s3a.server-side-encryption-algorithm
must be set to CSE-KMS in
core-site.xml
.
- Generate an AWS KMS Key ID from the AWS console for your bucket, with the same region as the storage bucket.
- If already created, view the KMS key ID following these steps.
- Set
fs.s3a.server-side-encryption-algorithm=CSE-KMS
. - Set
fs.s3a.server-side-encryption.key=<KMS_KEY_ID>
.
<property>
<name>fs.s3a.server-side-encryption-algorithm</name>
<value>CSE-KMS</value>
</property>
<property>
<name>fs.s3a.server-side-encryption.key</name>
<value>${KMS_KEY_ID}</value>
</property>