Updating an Object Storage Bucket to Use an SSE-KMS Bucket Key

Update a bucket to use the bucket key. By default, the bucket key is disabled.

Note

When you enable SSE-KMS Bucket Key, only new objects written after enabling Use Bucket Key. Existing objects remain encrypted under their previous wrapping. To migrate existing objects, run bucket re-encryption to re-encrypt the data encryption keys associated with those objects.

1. On the Buckets list page, select the Object Storage bucket that you want to work with. If you need help finding the list page or the bucket, see Listing Buckets.
  The Buckets list page opens. All buckets in the selected compartment are displayed in a table.
2. From the Actions menu (three dots) next to the relevant bucket, enable or disable Use Bucket Key.

Use the oci os bucket update command to enable the bucket key. For full command details, see oci os bucket update.

oci os bucket update --name bucket_name --is-bucket-key-enabled true --kms-key-id kms_key_ocid [OPTIONS]

For example:

$ oci os bucket update --name MyBucket --is-bucket-key-enabled true  --kms-key-id ocid1.key.oc1..exampleuniqueID
{
  "data": {
    "acl-group-id": null,
    "approximate-count": null,
    "approximate-size": null,
    "auto-tiering": "Disabled",
    "bucket-scope": "NAMESPACE",
    "compartment-id": "ocid1.tenancy.oc1..exampleuniqueID",
    "created-by": "ocid1.user.oc1..exampleuniqueID",
    "defined-tags": {},
    "etag": "edb210fc-2dab-48c7-bfe7-2485c9c7a782",
    "freeform-tags": {},
    "id": "ocid1.bucket.oc1.exampleuniqueID",
    "is-bucket-key-enabled": true,
    "is-read-only": false,
    "kms-key-id": "ocid1.key.oc1.iad.exampleuniqueID",
    "metadata": {},
    "name": "MyBucket",
    "namespace": "namespace",
    "object-events-enabled": false,
    "object-level-audit-mode": "Disabled",
    "object-lifecycle-policy-etag": null,
    "public-access-type": "NoPublicAccess",
    "replication-enabled": false,
    "soft-delete-policy": {
      "current-policy": {
        "cool-off-duration": null,
        "restore-duration": null,
        "soft-delete-mode": "Disabled",
        "time-activation": null
      },
      "next-policy": null,
      "time-modified": null
    },
    "storage-tier": "Standard",
    "time-created": "2026-01-16T20:18:55.494000+00:00",
    "versioning": "Disabled"
  },
  "etag": "edb210fc-2dab-48c7-bfe7-2485c9c7a782"
}

Note

If the bucket already has a KMS key associated, don't pass the --kms-key-id option again unless you're changing the key. Instead, just enable the bucket key.

Run the UpdateBucket operation.

When accessing the Object Storage API, the bucket name is used with the Object Storage namespace name to form the request URL:
```
n/object_storage_namespace/b/bucket
```

Oracle Cloud Infrastructure Documentation

Updating an Object Storage Bucket to Use an SSE-KMS Bucket Key