import quincy beta 17.1.0

[ceph.git] / ceph / doc / radosgw / encryption.rst

diff --git a/ceph/doc/radosgw/encryption.rst b/ceph/doc/radosgw/encryption.rst
index 0097b1b00814974e20eb1bda3e8cd955a178cfef..2b51e088f5356c4bbed5588fce14214c22197bf5 100644 (file)
--- a/ceph/doc/radosgw/encryption.rst
+++ b/ceph/doc/radosgw/encryption.rst
@@ -9,6 +9,13 @@ with 3 options for the management of encryption keys. Server-side encryption
 means that the data is sent over HTTP in its unencrypted form, and the Ceph
 Object Gateway stores that data in the Ceph Storage Cluster in encrypted form.
 
 means that the data is sent over HTTP in its unencrypted form, and the Ceph
 Object Gateway stores that data in the Ceph Storage Cluster in encrypted form.
 

+.. note:: Requests for server-side encryption must be sent over a secure HTTPS
+          connection to avoid sending secrets in plaintext. If a proxy is used
+          for SSL termination, ``rgw trust forwarded https`` must be enabled
+          before forwarded requests will be trusted as secure.
+
+.. note:: Server-side encryption keys must be 256-bit long and base64 encoded.
+

 Customer-Provided Keys
 ======================
 
 Customer-Provided Keys
 ======================
 


@@ -25,15 +32,25 @@ Key Management Service
 ======================
 
 This mode allows keys to be stored in a secure key management service and
 ======================
 
 This mode allows keys to be stored in a secure key management service and

-retrieved on demand by the Ceph Object Gateway to service requests to encrypt
+retrieved on demand by the Ceph Object Gateway to serve requests to encrypt

 or decrypt data.
 
 This is implemented in S3 according to the `Amazon SSE-KMS`_ specification.
 
 or decrypt data.
 
 This is implemented in S3 according to the `Amazon SSE-KMS`_ specification.
 

-In principle, any key management service could be used here, but currently
-only integration with `Barbican`_ is implemented.
+In principle, any key management service could be used here.  Currently
+integration with `Barbican`_, `Vault`_, and `KMIP`_ are implemented.
+
+See `OpenStack Barbican Integration`_, `HashiCorp Vault Integration`_,
+and `KMIP Integration`_.
+
+Bucket Encryption APIs
+======================
+
+Bucket Encryption APIs to support server-side encryption with Amazon
+S3-managed keys (SSE-S3) or AWS KMS customer master keys (SSE-KMS). 
+SSE-KMS implementation via BucketEncryption APIs is not supported yet.

 
 

-See `OpenStack Barbican Integration`_.
+See `PutBucketEncryption`_, `GetBucketEncryption`_, `DeleteBucketEncryption`_

 
 Automatic Encryption (for testing only)
 =======================================
 
 Automatic Encryption (for testing only)
 =======================================


@@ -53,4 +70,11 @@ The configuration expects a base64-encoded 256 bit key. For example::
 .. _Amazon SSE-C: https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html
 .. _Amazon SSE-KMS: http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html
 .. _Barbican: https://wiki.openstack.org/wiki/Barbican
 .. _Amazon SSE-C: https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html
 .. _Amazon SSE-KMS: http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html
 .. _Barbican: https://wiki.openstack.org/wiki/Barbican

+.. _Vault: https://www.vaultproject.io/docs/
+.. _KMIP: http://www.oasis-open.org/committees/kmip/
+.. _PutBucketEncryption: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
+.. _GetBucketEncryption: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html
+.. _DeleteBucketEncryption: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html

 .. _OpenStack Barbican Integration: ../barbican
 .. _OpenStack Barbican Integration: ../barbican

+.. _HashiCorp Vault Integration: ../vault
+.. _KMIP Integration: ../kmip