---
title: Enabling server-side encryption with Key Management Service (SSE-KMS) using the Scaleway console
description: Enable server-side encryption with Key Management Service (SSE-KMS) for Object Storage using the Scaleway console.
tags: object storage server side encryption kms cli scaleway own keys
dates:
  validation: 2026-06-03
  posted: 2026-06-04
---
import Requirements from '@macros/iam/requirements.mdx'
import SseKmsIntroduction from '@macros/object-storage/sse-kms-introduction.mdx'

This page explains how to use SSE-KMS with the Scaleway Console. To use it with the AWS CLI, refer to the [dedicated documentation](/object-storage/api-cli/enable-sse-kms/).

<SseKmsIntroduction />

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) (optional)


## How to enable SSE-KMS during bucket creation

When you [create a new Object Storage bucket](/object-storage/how-to/create-a-bucket/), follow these steps to enable SSE-KMS:

1. Tick the **Enable bucket encryption** box and select the **SSE-KMS** encryption type.

2. Select a KMS key. 

    The KMS key that you select here is the key encryption key (KEK) mentioned above. 
    
    You have the following options:

    - **Select an existing key**: Use the drop-down to select a key that you [set up earlier via Key Manager](/key-manager/how-to/create-km-key/).
    - **Create a new KMS key**: Provide a name for your new key. When you click **Create bucket**, a new key is created and available for managing via Key Manager.

      <Message type="note">
        If you choose to create a new KMS key, it is automatically created with the “Protected” status. The key cannot be deleted via the console or the API, preventing accidental removal. The only way to disable key protection is through [Key Manager](/key-manager/).
      </Message>   

Following bucket creation, objects pushed to this bucket will be automatically encrypted at rest with your keys generated via Key Manager.

<Message type="tip">
As a best practice, we recommend using a dedicated KMS key for each bucket, rather than sharing a single key across multiple buckets.
</Message>

## How to enable SSE-KMS on an existing bucket

1. Click **Object Storage** in the **Storage** section of the side menu. The list of your buckets displays.

2. Click the name of the desired bucket. The **Overview** tab displays.

3. Select the **Settings** tab.

4. Under **Bucket encryption**, click **Edit encryption mode**. A pop-up displays.

5. Tick the **Enable bucket encryption** box, then select **SSE-KMS**.

6. Select a KMS key. You have the following options:

    - **Select an existing key**: Use the drop-down to select a key that you [set up via Key Manager](/key-manager/how-to/create-km-key/) earlier.
    - **Create a new KMS key**: Provide a name for your new key. When you click **Confirm**, a new key is created and available for managing via Key Manager.

      The KMS key that you select here is the key encryption key (KEK) mentioned above.

7. Click **Confirm**.

New objects uploaded to this bucket will be automatically encrypted at rest with your keys generated via Key Manager.

<Message type="important">
Objects uploaded to this bucket before enabling SSE-KMS will not be encrypted.
</Message>

## How to disable SSE-KMS on an existing bucket

1. Click **Object Storage** in the **Storage** section of the side menu. The list of your buckets displays.

2. Click the name of the desired bucket. The **Overview** tab displays.

3. Select the **Settings** tab.

4. Under **Bucket encryption**, click **Edit encryption mode**. A pop-up displays.

5. Uncheck the **Enable bucket encryption** box.

6. Click **Confirm**. The **Disable encryption for my bucket** pop-up displays.

7. Type **DISABLE**, then click **Confirm**.

    <Message type="important">
    Once the change is applied, the encryption key (the KEK) will disappear from the bucket view, but objects encrypted with the previous SSE‑KMS configuration still depend on it. The key will remain available in Key Manager, but remember to not remove it. Deleting the key will make all previously encrypted objects inaccessible permanently.
    </Message>

New objects uploaded to this bucket will not be encrypted. However, objects uploaded while SSE-KMS was enabled will remain encrypted.