Server-Side Encryption

Encrypt new objects stored in a Stook Bucket at rest with AES-256.

Configure server-side encryption to encrypt new objects stored in a Stook Bucket at rest.

When Server-Side Encryption is enabled, Stook encrypts objects before writing them to disk and decrypts them when they are read. Encryption keys are managed by Medianova and do not require customer-side key creation, storage, or rotation.

Enabling Server-Side Encryption does not encrypt objects already stored in the Stook Bucket. Only objects uploaded after the setting is enabled are encrypted.

For complete request parameters, response schemas, and error responses, see Bucket Settings API.

How Server-Side Encryption Works

Server-Side Encryption uses AES-256 encryption for objects stored at rest.

The following behavior applies:

• New objects are encrypted before they are written to disk.

• Objects are decrypted automatically when they are read.

• Multipart uploads are encrypted.

• Uploads made with any access key are encrypted.

• Existing objects are not modified when Server-Side Encryption is enabled.

• Disabling Server-Side Encryption does not decrypt objects that were previously encrypted.

Encryption and decryption are handled by the storage service. Applications can continue uploading and retrieving objects without changes to their request flow.

To encrypt an object that was stored before Server-Side Encryption was enabled, upload the object again after enabling the setting.

Configure Server-Side Encryption

1

Open the Stook Bucket

In the Medianova Control Panel, select Stook Object Storage → Buckets, then select the Stook Bucket you want to configure.

2

Open Server-Side Encryption

On the Bucket configuration page, select Server-side encryption.

3

Enable Server-Side Encryption

Turn on Enabled.

4

Save the configuration

Select Save Changes.

Configuration Fields

Field	Description	Default
Enabled	Encrypts new objects stored in the Stook Bucket at rest with AES-256.	Off

Check Object Encryption

You can use an S3-compatible client such as the AWS CLI to check whether an object is encrypted.

aws s3api --endpoint-url https://<ENDPOINT_URL> \
  head-object \
  --bucket <BUCKET_NAME> \
  --key <OBJECT_KEY>

The command sends a metadata request for the specified object without downloading the object itself.

For an encrypted object, the response includes ServerSideEncryption:

{
  "ServerSideEncryption": "AES256",
  ...
}

If ServerSideEncryption is not present in the response, the object is not encrypted with Server-Side Encryption. For example, the object may have been uploaded before the setting was enabled.

Disable Server-Side Encryption

To stop encrypting new uploads:

1

Open Server-Side Encryption

On the Bucket configuration page, select Server-side encryption.

2

Disable Server-Side Encryption

Turn off Enabled.

3

Save the configuration

Select Save Changes.

Objects encrypted while Server-Side Encryption was enabled remain encrypted and readable. Objects uploaded after the setting is disabled are stored without Server-Side Encryption.

Configure Server-Side Encryption with the API

Use the bucket settings endpoint to enable Server-Side Encryption:

PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings

Send:

{
  "sse_enabled": true
}

The request enables Server-Side Encryption for new objects uploaded to the Stook Bucket.

To disable Server-Side Encryption, send:

{
  "sse_enabled": false
}

Previously encrypted objects remain encrypted and readable after the setting is disabled.

Important Notes

• Server-Side Encryption applies only to objects uploaded while the setting is enabled.

• Existing objects are not encrypted automatically.

• Previously encrypted objects remain encrypted after Server-Side Encryption is disabled.

• Encryption keys are managed by Medianova and cannot be managed directly by customers.

• Applications do not require changes to upload or retrieve encrypted objects.

Related Topics

• Bucket Configuration

• Versioning

• Manage Access Keys