> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/object-storage-stook/bucket-configuration/server-side-encryption.md).

# Server-Side Encryption

Encrypt new objects stored in a Stook Bucket at rest with AES-256.

Configure server-side encryption to encrypt new objects stored in a Stook Bucket at rest.

When **Server-Side Encryption** is enabled, Stook encrypts objects before writing them to disk and decrypts them when they are read. Encryption keys are managed by Medianova and do not require customer-side key creation, storage, or rotation.

{% hint style="warning" %}
Enabling Server-Side Encryption does not encrypt objects already stored in the Stook Bucket. Only objects uploaded after the setting is enabled are encrypted.
{% endhint %}

{% hint style="info" %}
For complete request parameters, response schemas, and error responses, see [Bucket Settings API](/api-documentation/object-storage-stook/buckets/settings.md).
{% endhint %}

## How Server-Side Encryption Works

Server-Side Encryption uses AES-256 encryption for objects stored at rest.

The following behavior applies:

* New objects are encrypted before they are written to disk.
* Objects are decrypted automatically when they are read.
* Multipart uploads are encrypted.
* Uploads made with any access key are encrypted.
* Existing objects are not modified when Server-Side Encryption is enabled.
* Disabling Server-Side Encryption does not decrypt objects that were previously encrypted.

Encryption and decryption are handled by the storage service. Applications can continue uploading and retrieving objects without changes to their request flow.

To encrypt an object that was stored before Server-Side Encryption was enabled, upload the object again after enabling the setting.

## Configure Server-Side Encryption

{% stepper %}
{% step %}

### **Open the Stook Bucket**

In the [Medianova Control Panel](https://cloud.medianova.com), select **Stook Object Storage → Buckets**, then select the Stook Bucket you want to configure.
{% endstep %}

{% step %}

### **Open Server-Side Encryption**

On the **Bucket configuration** page, select **Server-side encryption**.

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2F6OnccXJ1bmw7ZnfJQzsd%2Fimage.png?alt=media&amp;token=a4546fa2-d19b-457e-ba10-545bef1e8779" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Enable Server-Side Encryption**

Turn on **Enabled**.
{% endstep %}

{% step %}

### **Save the configuration**

Select **Save Changes**.
{% endstep %}
{% endstepper %}

## Configuration Fields

<table><thead><tr><th width="148.800048828125">Field</th><th width="463.60009765625">Description</th><th>Default</th></tr></thead><tbody><tr><td><strong>Enabled</strong></td><td>Encrypts new objects stored in the Stook Bucket at rest with AES-256.</td><td>Off</td></tr></tbody></table>

## Check Object Encryption

You can use an S3-compatible client such as the AWS CLI to check whether an object is encrypted.

```bash
aws s3api --endpoint-url https://<ENDPOINT_URL> \
  head-object \
  --bucket <BUCKET_NAME> \
  --key <OBJECT_KEY>
```

The command sends a metadata request for the specified object without downloading the object itself.

For an encrypted object, the response includes `ServerSideEncryption`:

```json
{
  "ServerSideEncryption": "AES256",
  ...
}
```

If `ServerSideEncryption` is not present in the response, the object is not encrypted with Server-Side Encryption. For example, the object may have been uploaded before the setting was enabled.

## Disable Server-Side Encryption

To stop encrypting new uploads:

{% stepper %}
{% step %}

### **Open Server-Side Encryption**

On the **Bucket configuration** page, select **Server-side encryption**.
{% endstep %}

{% step %}

### **Disable Server-Side Encryption**

Turn off **Enabled**.
{% endstep %}

{% step %}

### **Save the configuration**

Select **Save Changes**.
{% endstep %}
{% endstepper %}

Objects encrypted while Server-Side Encryption was enabled remain encrypted and readable. Objects uploaded after the setting is disabled are stored without Server-Side Encryption.

## Configure Server-Side Encryption with the API

Use the bucket settings endpoint to enable Server-Side Encryption:

```http
PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings
```

Send:

```json
{
  "sse_enabled": true
}
```

The request enables Server-Side Encryption for new objects uploaded to the Stook Bucket.

To disable Server-Side Encryption, send:

```json
{
  "sse_enabled": false
}
```

Previously encrypted objects remain encrypted and readable after the setting is disabled.

## Important Notes

* Server-Side Encryption applies only to objects uploaded while the setting is enabled.
* Existing objects are not encrypted automatically.
* Previously encrypted objects remain encrypted after Server-Side Encryption is disabled.
* Encryption keys are managed by Medianova and cannot be managed directly by customers.
* Applications do not require changes to upload or retrieve encrypted objects.

## Related Topics

* [Bucket Configuration](/products/object-storage-stook/bucket-configuration.md)
* [Versioning](/products/object-storage-stook/bucket-configuration/versioning.md)
* [Manage Access Keys](/products/object-storage-stook/manage-access-keys.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://clients.medianova.com/products/object-storage-stook/bucket-configuration/server-side-encryption.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.