How to Use Server Side Encryption (SSE-C) with S3 Object Storage on Vultr

Introduction

Object Storage combined with Server Side Encryption (SSE-C) offers a robust solution for securely storing and managing data in the cloud. Vultr's Object Storage service provides a reliable platform for storing large amounts of unstructured data, such as media files, backups, and archives. SSE-C (Server-Side Encryption with Customer-Provided Key) allows users to provide their own encryption key, which the cloud service provider uses to encrypt data on the server side before storing it. This ensures that data remains confidential and secure throughout its lifecycle,

This article will guide you through the process of setting up an Ubuntu server on Vultr, configuring Vultr Object Storage, and utilizing SSE-C to upload and download encrypted objects.

Prerequisites

Before you begin:

• Deploy an Ubuntu 24.04 server instance on Vultr.

• Deploy a Vultr S3 object storage and create a bucket.

• Access the server using SSH as a non-root user with sudo privileges.

• Update the server.

Upload and Download objects with AWS CLI using SSE-C

In this section, you will learn how to securely upload and download objects using Server Side Encryption with Customer-Provided Keys (SSE-C) on Vultr Object Storage. You'll follow the steps to set up dependencies, configure AWS CLI, upload and download objects using AWS CLI s3 cp, put-object and get-object.

1. Install the openssl dependency.

   CONSOLE

   Copy

   $ sudo apt-get install openssl

   Explain Code

   Powered by Vultr AgentBeta

2. Generate a random 32-byte encryption key.

   CONSOLE

   Copy

   $ openssl rand -out encryption_key.bin 32

   Explain Code

   Powered by Vultr AgentBeta

   The generated key will be stored in a file named encryption_key.bin.

3. Create a new text file to upload it to the S3 bucket.

   CONSOLE

   Copy

   $ nano sample.txt

   Explain Code

   Powered by Vultr AgentBeta

4. Copy and paste the below text.

   This is a sample file that will be uploaded to the S3 bucket.

   Save and close the file.

5. Download the AWS CLI installation file.

   CONSOLE

   Copy

   $ curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"

   Explain Code

   Powered by Vultr AgentBeta

6. Unzip the installation file.

   CONSOLE

   Copy

   $ unzip awscliv2.zip

   Explain Code

   Powered by Vultr AgentBeta

7. Run the install program.

   CONSOLE

   Copy

   $ sudo ./aws/install

   Explain Code

   Powered by Vultr AgentBeta

8. Verify the installation.

   CONSOLE

   Copy

   $ aws --version

   Explain Code

   Powered by Vultr AgentBeta

9. Configure the AWS CLI.

   CONSOLE

   Copy

   $ aws configure --profile vultr_ewr

   Explain Code

   Powered by Vultr AgentBeta

   Follow the prompts and provide your access key and secret key along with the default origin.

10. Upload an object using AWS CLI s3 cp.

    CONSOLE

    Copy

    $ aws --endpoint-url https://<vultr endpoint>.com --profile vultr_ewr s3 cp /path/to/local/sample.txt s3://your-bucket-name/remote-file-name.txt --sse-c AES256 --sse-c-key fileb://encryption_key.bin

    Explain Code

    Powered by Vultr AgentBeta

    Ensure the following:

    • Replace <vultr endpoint> with your actual Vultr Object Storage endpoint.

    • Replace <your-bucket-name> with your actual bucket name.

    • Replace /path/to/local/sample.txt with the path to your local file for upload.

    Confirm that the file has been uploaded to the bucket.

    

11. Download an object using AWS CLI s3 cp.

    CONSOLE

    Copy

    $ aws --endpoint-url https://<vultr endpoint>.com --profile vultr_ewr s3 cp s3://your-bucket-name/remote-file-name.txt /path/to/local/download.txt --sse-c AES256 --sse-c-key fileb://encryption_key.bin

    Explain Code

    Powered by Vultr AgentBeta

    Replace /path/to/local/download.txt with the desired local path for downloaded files.

12. Upload an object using AWS CLI put-object.

    CONSOLE

    Copy

    $ aws --endpoint-url https://<vultr endpoint>.com --profile vultr_ewr s3api put-object --bucket your-bucket-name --key new-remote-file.txt --body /path/to/local/sample.txt --sse-customer-algorithm AES256 --sse-customer-key fileb://encryption_key.bin

    Explain Code

    Powered by Vultr AgentBeta

    Confirm that the file has been uploaded to the bucket.

    

13. Download an object using AWS CLI get-object.

    CONSOLE

    Copy

    $ aws --endpoint-url https://<vultr endpoint>.com --profile vultr_ewr s3api get-object --bucket your-bucket-name --key new-remote-file.txt /path/to/local/download.txt --sse-customer-algorithm AES256 --sse-customer-key fileb://s3_enc.key

    Explain Code

    Powered by Vultr AgentBeta

Upload and Download Objects using SSE-C

In this section, You'll follow steps to set up dependencies, configure environment variables, and use a Python script for automated encryption, upload, download, and decryption processes.

1. Install the boto3 dependency.

   CONSOLE

   Copy

   $ sudo apt install python3-boto3

   Explain Code

   Powered by Vultr AgentBeta

2. Create environment variables for S3 bucket credentials.

   CONSOLE

   Copy

   $ export AWS_ACCESS_KEY_ID=<your_access_key>
   $ export AWS_SECRET_ACCESS_KEY=<your_secret_key>

   Explain Code

   Powered by Vultr AgentBeta

Create a Python Script to Upload and Download Files

1. Create a new Python file.

   CONSOLE

   Copy

   $ nano vultr_object_storage_sse_c.py

   Explain Code

   Powered by Vultr AgentBeta

2. Import the dependencies and environment variables.

   PYTHON

   Copy

   import os
   import boto3
   import subprocess

   Explain Code

   Powered by Vultr AgentBeta

3. In the Python file, create a constant for the encryption key file and retrieve the S3 credentials.

   PYTHON

   Copy

   KEY_FILE = "encryption_key.bin"
   
   access_key = os.environ.get("AWS_ACCESS_KEY_ID")
   secret_key = os.environ.get("AWS_SECRET_ACCESS_KEY")

   Explain Code

   Powered by Vultr AgentBeta

4. In the Python file, generate the encryption key if not already present else read the encryption key from the file.

   PYTHON

   Copy

   if not os.path.exists(KEY_FILE):
       openssl_cmd = ["openssl", "rand", "-out", KEY_FILE, "32"]
       subprocess.check_call(openssl_cmd)
   
   with open(KEY_FILE, "rb") as f:
   ENCRYPTION_KEY = f.read()

   Explain Code

   Powered by Vultr AgentBeta

5. In the Python file, define the encryption algorithm and S3 Details and read the local file content.

   PYTHON

   Copy

   ALGO = "AES256"
   BUCKET = "<bucket_name>"
   FILE = "sample.txt"
   LOCAL_FILE_PATH = "path/to/sample.txt"
   
   with open(LOCAL_FILE_PATH, "rb") as file:
       file_content = file.read()

   Explain Code

   Powered by Vultr AgentBeta

6. In the Python file, initialize the Boto3 client for S3.

   PYTHON

   Copy

   client = boto3.client(
       "s3",
       aws_access_key_id=access_key,
       aws_secret_access_key=secret_key,
       endpoint_url="http://<your_s3_endpoint_url>",
   )

   Explain Code

   Powered by Vultr AgentBeta

7. In the Python file, upload the file to S3 with Server-Side Encryption using Customer-Provided Key (SSE-C).

   PYTHON

   Copy

   print("Uploading file to Vultr Object Storage with SSE-C...")
   client.put_object(
       SSECustomerKey=ENCRYPTION_KEY,
       SSECustomerAlgorithm=ALGO,
       Bucket=BUCKET,
       Key=FILE,
       Body=file_content,
   )
   print("Upload successful.")

   Explain Code

   Powered by Vultr AgentBeta

8. In the Python file, download and decrypt the encrypted file.

   PYTHON

   Copy

   print("Downloading the encrypted file...")
   response = client.get_object(
       SSECustomerKey=ENCRYPTION_KEY,
       SSECustomerAlgorithm=ALGO,
       Bucket=BUCKET,
       Key=FILE,
   )
   
   decrypted_content = response["Body"].read().decode("utf-8")
   print("Decrypted content:", decrypted_content)

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

9. Run the Python script.

   CONSOLE

   Copy

   $ python3 vultr_object_storage_sse_c.py

   Explain Code

   Powered by Vultr AgentBeta

10. Confirm the presence of the uploaded file in the Vultr dashboard.

    

Conclusion

Throughout this article, you've learned how to effectively utilize Server Side Encryption with Customer-Provided Keys (SSE-C) on Vultr Object Storage. By following the steps outlined, you've successfully set up an Ubuntu server on Vultr, configured Object Storage, and implemented SSE-C to securely upload and download encrypted objects.