---
title: Enabling server-side encryption with Key Management Service (SSE-KMS) using the AWS CLI
description: Enable server-side encryption with Key Management Service (SSE-KMS) for Scaleway Object Storage.
tags: object storage server side encryption sse kms cli scaleway own keys
dates:
  validation: 2026-06-04
  posted: 2026-06-04
---
import Requirements from '@macros/iam/requirements.mdx'
import SseKmsIntroduction from '@macros/object-storage/sse-kms-introduction.mdx'

This page explains how to use SSE-KMS with the AWS CLI. To use it with the Scaleway console, refer to the [dedicated documentation](/object-storage/how-to/enable-sse-kms/).

<SseKmsIntroduction />

When it comes to setting up your key architecture, the recommended practice is to always set default bucket encryption by enabling a Bucket Key via [PutBucketEncryption](/object-storage/api-cli/bucket-operations/#putbucketencryption). When this is active and you have configured SSE‑KMS, Object Storage automatically creates a Bucket Key that is encrypted with your KMS key (the KEK). The Bucket Key, in turn, encrypts the per‑object data encryption keys (DEKs) that protect the actual object data.

In cases when you have some objects that are stored without SSE‑KMS, you can:
- Re‑upload an object and [enable SSE‑KMS for that specific object upload](#enabling-sse-kms-for-an-object-upload)
- Copy an object using the same bucket as the source and the destination and [enable SSE‑KMS for that specific copy operation](#enable-ssekms-for-a-specific-copy-operation)

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- An [Object Storage bucket](/object-storage/how-to/create-a-bucket/)
- Installed and initialized the [AWS CLI](/object-storage/api-cli/object-storage-aws-cli/)

## Enabling SSE-KMS for an object upload

In a terminal, run the following command. Remember to replace placeholders with actual values. 

  ```bash
  aws s3api put-object \
  --bucket <your-bucket-name> \
  --key <your-object-key> \
  --server-side-encryption aws:kms \
  --bucket-key-enabled 
  --ssekms-key-id <your-kms-key-id> \ 
  --body <path-to-file-to-upload>
  ```    
An output similar to the following displays:

  ```json
  {
  "ETag": "\"<object-metadata>\"",
  "ChecksumCRC64NVME": "<checksum-value>",
  "ChecksumType": "FULL_OBJECT",
  "ServerSideEncryption": "aws:kms",
  "SSEKMSKeyId": "<your-kms-key-id>",
  "BucketKeyEnabled": true
  }
  ```

## Enable SSE‑KMS for a specific copy operation

In a terminal, run the following command. Remember to replace placeholders with actual values. 

  ```bash
  aws s3api copy-object \
  --copy-source <your-bucket-name>/<your-object-filename> \
  --key <your-object-key> \
  --bucket <your-bucket-name> \
  --server-side-encryption aws:kms \
  --bucket-key-enabled \
  --sse-kms-key-id <your-kms-key-id>
  ```

An output similar to the following displays:

  ```json
    {
      "ServerSideEncryption": "aws:kms",
      "SSEKMSKeyId": "<your-kms-key-id>",
      "BucketKeyEnabled": true,
      "CopyObjectResult": {
          "ETag": "\"<object-metadata>\"",
          "LastModified": "yyyy-MM-ddTHH:mm:ss.SSSZ",
          "ChecksumCRC64NVME": "<checksum-value>"
      }
  }
  ```