From 09a8c15a3ab1358703f7fbacae48bcc028da5dd1 Mon Sep 17 00:00:00 2001 From: Pierre Dulac Date: Thu, 13 Aug 2026 13:22:14 +0200 Subject: [PATCH 1/3] feat(object-storage): document Key Manager permissions required for SSE-KMS --- pages/object-storage/api-cli/enable-sse-kms.mdx | 5 +++++ pages/object-storage/how-to/enable-sse-kms.mdx | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/pages/object-storage/api-cli/enable-sse-kms.mdx b/pages/object-storage/api-cli/enable-sse-kms.mdx index 61c7a49125..c483763cfb 100644 --- a/pages/object-storage/api-cli/enable-sse-kms.mdx +++ b/pages/object-storage/api-cli/enable-sse-kms.mdx @@ -25,6 +25,11 @@ In cases when you have some objects that are stored without SSE‑KMS, you can: - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) - Installed and initialized the [AWS CLI](/object-storage/api-cli/object-storage-aws-cli/) +- [Key Manager permission sets](/iam/reference-content/permission-sets/#key-manager) for every [principal](/iam/concepts/#principal) that reads or writes objects in the bucket: `KeyManagerKeyEncrypt` for `PutObject`, and `KeyManagerKeyDecrypt` for `GetObject` + + +Object Storage permission sets alone are not sufficient to read and write objects encrypted with SSE-KMS. An [application](/iam/concepts/#application) holding `ObjectStorageFullAccess` and no Key Manager permission set gets an access denied error when it calls `PutObject` on a bucket that has default encryption enabled, even when the KEK and the bucket are in the same Project. + ## Enabling SSE-KMS for an object upload diff --git a/pages/object-storage/how-to/enable-sse-kms.mdx b/pages/object-storage/how-to/enable-sse-kms.mdx index dab902e07f..c3468b86d2 100644 --- a/pages/object-storage/how-to/enable-sse-kms.mdx +++ b/pages/object-storage/how-to/enable-sse-kms.mdx @@ -18,7 +18,11 @@ This page explains how to use SSE-KMS with the Scaleway Console. To use it with - A Scaleway account logged into the [console](https://console.scaleway.com) - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) (optional) +- [Key Manager permission sets](/iam/reference-content/permission-sets/#key-manager) for every [principal](/iam/concepts/#principal) that reads or writes objects in the bucket: `KeyManagerKeyEncrypt` to upload objects, and `KeyManagerKeyDecrypt` to download them + +Object Storage permission sets alone are not sufficient to read and write objects encrypted with SSE-KMS. A principal holding `ObjectStorageFullAccess` and no Key Manager permission set gets an access denied error when it uploads an object to a bucket that has default encryption enabled, even when the KEK and the bucket are in the same Project. + ## How to enable SSE-KMS during bucket creation From 1811bc18999f549055270a046455ea46aaec679e Mon Sep 17 00:00:00 2001 From: Pierre Dulac Date: Thu, 13 Aug 2026 13:22:14 +0200 Subject: [PATCH 2/3] feat(iam): note that Object Storage SSE-KMS callers need Key Manager encrypt and decrypt --- pages/iam/reference-content/permission-sets.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pages/iam/reference-content/permission-sets.mdx b/pages/iam/reference-content/permission-sets.mdx index e82993c868..5b879d1489 100644 --- a/pages/iam/reference-content/permission-sets.mdx +++ b/pages/iam/reference-content/permission-sets.mdx @@ -416,6 +416,10 @@ Below is a list of the permission sets available at Scaleway. | KeyManagerKeyCreate | Create permission to key manager | | KeyManagerKeyRestore | Restore permission to key manager | + + `KeyManagerKeyEncrypt` and `KeyManagerKeyDecrypt` are also required by principals that never call Key Manager directly: uploading to and downloading from an Object Storage bucket encrypted with [SSE-KMS](/object-storage/how-to/enable-sse-kms/) needs them in addition to the relevant Object Storage permission sets. + + ### Labs #### Quantum From 00ad14a11a6447c2cbb1dc5826836cfaa401a2e3 Mon Sep 17 00:00:00 2001 From: Loic-kd Date: Fri, 14 Aug 2026 15:55:49 +0200 Subject: [PATCH 3/3] Apply suggestions from code review Co-authored-by: vanda-scw --- pages/iam/reference-content/permission-sets.mdx | 2 +- pages/object-storage/api-cli/enable-sse-kms.mdx | 2 +- pages/object-storage/how-to/enable-sse-kms.mdx | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pages/iam/reference-content/permission-sets.mdx b/pages/iam/reference-content/permission-sets.mdx index 5b879d1489..61b3b4c96f 100644 --- a/pages/iam/reference-content/permission-sets.mdx +++ b/pages/iam/reference-content/permission-sets.mdx @@ -417,7 +417,7 @@ Below is a list of the permission sets available at Scaleway. | KeyManagerKeyRestore | Restore permission to key manager | - `KeyManagerKeyEncrypt` and `KeyManagerKeyDecrypt` are also required by principals that never call Key Manager directly: uploading to and downloading from an Object Storage bucket encrypted with [SSE-KMS](/object-storage/how-to/enable-sse-kms/) needs them in addition to the relevant Object Storage permission sets. + `KeyManagerKeyEncrypt` and `KeyManagerKeyDecrypt` are also required for principals that never call Key Manager directly: uploading to and downloading from an Object Storage bucket encrypted with [SSE-KMS](/object-storage/how-to/enable-sse-kms/) requires these permissions in addition to the relevant Object Storage permission sets. ### Labs diff --git a/pages/object-storage/api-cli/enable-sse-kms.mdx b/pages/object-storage/api-cli/enable-sse-kms.mdx index c483763cfb..89af063bdc 100644 --- a/pages/object-storage/api-cli/enable-sse-kms.mdx +++ b/pages/object-storage/api-cli/enable-sse-kms.mdx @@ -28,7 +28,7 @@ In cases when you have some objects that are stored without SSE‑KMS, you can: - [Key Manager permission sets](/iam/reference-content/permission-sets/#key-manager) for every [principal](/iam/concepts/#principal) that reads or writes objects in the bucket: `KeyManagerKeyEncrypt` for `PutObject`, and `KeyManagerKeyDecrypt` for `GetObject` -Object Storage permission sets alone are not sufficient to read and write objects encrypted with SSE-KMS. An [application](/iam/concepts/#application) holding `ObjectStorageFullAccess` and no Key Manager permission set gets an access denied error when it calls `PutObject` on a bucket that has default encryption enabled, even when the KEK and the bucket are in the same Project. +Object Storage permission sets alone are not sufficient to read and write objects encrypted with SSE-KMS. An [application](/iam/concepts/#application) that has `ObjectStorageFullAccess` and no Key Manager permission set receives an "access denied" error when it calls `PutObject` on a bucket that has default encryption enabled, even when the KEK and the bucket are in the same Project. ## Enabling SSE-KMS for an object upload diff --git a/pages/object-storage/how-to/enable-sse-kms.mdx b/pages/object-storage/how-to/enable-sse-kms.mdx index c3468b86d2..538d12337b 100644 --- a/pages/object-storage/how-to/enable-sse-kms.mdx +++ b/pages/object-storage/how-to/enable-sse-kms.mdx @@ -21,7 +21,7 @@ This page explains how to use SSE-KMS with the Scaleway Console. To use it with - [Key Manager permission sets](/iam/reference-content/permission-sets/#key-manager) for every [principal](/iam/concepts/#principal) that reads or writes objects in the bucket: `KeyManagerKeyEncrypt` to upload objects, and `KeyManagerKeyDecrypt` to download them -Object Storage permission sets alone are not sufficient to read and write objects encrypted with SSE-KMS. A principal holding `ObjectStorageFullAccess` and no Key Manager permission set gets an access denied error when it uploads an object to a bucket that has default encryption enabled, even when the KEK and the bucket are in the same Project. +Object Storage permission sets alone are not sufficient to read and write objects encrypted with SSE-KMS. A principal that has `ObjectStorageFullAccess` and no Key Manager permission set receives an "access denied" error when it uploads an object to a bucket that has default encryption enabled, even when the KEK and the bucket are in the same Project. ## How to enable SSE-KMS during bucket creation