Skip to content

docs: document S3 SSE-KMS support and deprecate SSE-C#15375

Open
cuppett wants to merge 1 commit into
nextcloud:masterfrom
cuppett:feat/s3-sse-kms-primary-storage
Open

docs: document S3 SSE-KMS support and deprecate SSE-C#15375
cuppett wants to merge 1 commit into
nextcloud:masterfrom
cuppett:feat/s3-sse-kms-primary-storage

Conversation

@cuppett

@cuppett cuppett commented Jul 25, 2026

Copy link
Copy Markdown

Add documentation for the SSE-KMS (AWS Key Management Service) server-side encryption
support introduced in Nextcloud 34 (nextcloud/server#57623). Mark SSE-C as deprecated,
noting the AWS policy change that disabled SSE-C by default on new S3 buckets in April
2026 and recommending SSE-KMS for new deployments.

Changes:

  • primary_storage.rst — adds sse_kms_enabled and sse_kms_key_id to the S3
    optional parameters list; marks the SSE-C section .. deprecated:: 34 with a
    .. warning:: about the AWS policy change; adds a new "S3 SSE-KMS encryption support"
    section (.. versionadded:: 34) with two configuration examples (specific KMS key ARN
    and bucket-default key); also fixes the SSE-C code example (replaces array() syntax
    with [] and switches the bare :: blocks to .. code-block:: php/bash)
  • config_sample_php_parameters.rst — adds sse_kms_enabled, sse_kms_key_id, and
    sse_c_key with descriptive inline comments to the S3 objectstore sample block
  • encryption_configuration.rst — expands the SSE note to cross-reference both SSE-KMS
    (recommended) and the deprecated SSE-C sections via :ref: and :doc: links

☑️ Resolves

🖼️ Screenshots

Screenshot From 2026-07-25 08-47-12 Screenshot From 2026-07-25 08-47-42 Screenshot From 2026-07-25 08-48-00 Screenshot From 2026-07-25 08-49-17

✅ Checklist

  • I have built the documentation locally and reviewed the output
  • Screenshots are included for visual changes
  • I have not moved or renamed pages (or added a redirect if I did)
  • I have run codespell or similar and addressed any spelling issues

Add documentation for the SSE-KMS (AWS Key Management Service) server-side
encryption support introduced in Nextcloud 34 (nextcloud/server#57623).
Mark SSE-C as deprecated, noting the AWS policy change that disabled SSE-C
by default on new S3 buckets in April 2026 and recommending SSE-KMS for
new deployments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Stephen Cuppett <steve@cuppett.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant