> For the complete documentation index, see [llms.txt](https://help.connected.illumina.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.connected.illumina.com/connected-analytics/home/h-storage/s-awss3/s-sse-kms.md). # SSE-KMS Encryption This section describes how to connect an AWS S3 Bucket with [SSE-KMS Encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html) enabled. General instructions for configuring your AWS account to allow Platform Core to connect to an S3 bucket are found on [this page](/connected-analytics/home/h-storage/s-awss3.md). {% embed url="" %} Connect an AWS S3 Bucket with SSE-KMS Encryption Enabled {% endembed %} ## Create an S3 bucket with SSE-KMS Follow the [AWS instructions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/configuring-bucket-key.html) for how to create S3 bucket with SSE-KMS key. {% hint style="warning" %} S3-SSE-KMS must be in the same region as your Platform Core project. See the [Platform Core S3 bucket documentation ](/connected-analytics/home/h-storage/s-awss3.md)for more information. {% endhint %} In the "Default encryption" section, enable Server-side encryption and choose `AWS Key Management Service key (SSE-KMS)`. Then select `Choose your AWS KMS key`. {% hint style="info" %} If you do not have an existing customer managed key, click `Create a KMS key` and follow [these steps](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html) from AWS. {% endhint %}
{% hint style="warning" %} Once the bucket is set, create a folder with encryption enabled in the bucket that will be linked in the Platform Core storage configuration. This folder will be connected to Platform Core as a [prefix](#create-the-s3-sse-kms-configuration-in-platform-core). Although it is technically possible to use the **root folder**, this **is not recommended** as it will cause the S3 bucket to no longer be available for other projects. {% endhint %} ![sse-kms-1](/files/1P8CVXEh98PvVyhOOENK) ## Connect the S3-SSE-KMS to Platform Core Follow the [general instructions ](/connected-analytics/home/h-storage/s-awss3.md)for connecting an S3 bucket to Platform Core. In the step [Create AWS IAM Policy (IAM User)](/connected-analytics/home/h-storage/s-awss3/iam-user-method.md#create-data-access-permission-aws-iam-policy) or [Create AWS IAM Policy (IAM Role)](/connected-analytics/home/h-storage/s-awss3/iam-role-method.md#create-data-access-permission-aws-iam-policy) update the following: * Add permission to use KMS key by adding `kms:Decrypt`, `kms:Encrypt`, and `kms:GenerateDataKey` * Add the ARN KMS key `arn:aws:kms:xxx` on the first "Resource" * Depending on the bucket type (Unversioned, Versioned or Suspended) the permissions must match the following. {% tabs %} {% tab title="Unversioned" %} ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "s3:PutBucketNotification", "s3:ListBucket", "s3:GetBucketNotification", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:kms:xxx", "arn:aws:s3:::YOUR_BUCKET_NAME" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:RestoreObject", "s3:DeleteObject", "s3:GetObjectTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/YOUR_FOLDER_NAME/*" }, { "Effect": "Allow", "Action": [ "sts:GetFederationToken" ], "Resource": [ "*" ] } ] } ``` {% endtab %} {% tab title="Versioned or Suspended" %} ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "s3:PutBucketNotification", "s3:ListBucket", "s3:GetBucketNotification", "s3:GetBucketLocation", "s3:ListBucketVersions", "s3:GetBucketVersioning" ], "Resource": [ "arn:aws:kms:xxx", "arn:aws:s3:::YOUR_BUCKET_NAME" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:RestoreObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObjectVersion", "s3:GetObjectTagging", "s3:PutObjectTagging", "s3:GetObjectVersionTagging", "s3:PutObjectVersionTagging" ], "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/YOUR_FOLDER_NAME/*" }, { "Effect": "Allow", "Action": [ "sts:GetFederationToken" ], "Resource": [ "*" ] } ] } ``` {% endtab %} {% endtabs %} At the end of the policy setting, there should be 3 permissions listed in the "Summary". ![sse-kms-2](/files/DrCRzpxhHa8Dg1fAsfKl) ## Create S3-SSE-KMS configuration in Platform Core Follow the [general instructions](/connected-analytics/home/h-storage.md#create-a-storage-configuration) for how to create a storage configuration in Platform Core. On step 3 in process above, continue with the `[Optional] Server Side Encryption` to enter the algorithm and key name for server-side encryption processes. * On "Algorithm", input `aws:kms` * On "Key Name", input the ARN KMS key: `arn:aws:kms:xxx` {% hint style="warning" %} Although "Key prefix" is optional, it is highly recommended to use this and not use the root folder of your S3 bucket. "Key prefix" refers to the folder name in the bucket which you created. Once a key prefix is used in a storage configuration, no additional storage configurations can be created under that same path. {% endhint %}
## Cross-Account Copy Setup for S3 buckets with SSE-KMS encryption ### KMS Policy In addition to following the instructions to [Enable Cross-Account Access (IAM User)](/connected-analytics/home/h-storage/s-awss3/iam-user-method.md#enabling-cross-account-access-for-copy-and-move-operations) and [Enable Cross-Account Access (IAM Role)](/connected-analytics/home/h-storage/s-awss3/iam-role-method.md#enabling-cross-account-access-for-copy-and-move-operations), the **KMS policy** must include the following statement for AWS S3 Bucket with SSE-KMS Encryption (refer to the Role ARN table from the IAM user or IAM role page for the `ASSUME_ROLE_ARN` value): ```json { "Sid": "AllowCrossAccountAccess", "Effect": "Allow", "Principal": { "AWS": "ASSUME_ROLE_ARN" }, "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ], "Resource": "*" } ``` ## Key Update If your bucket uses *SSE-KMS* encryption with a self-managed key and you want to update your key, two things must stay in sync for Illumina to read your data: * **The key must match**: the key configured in your Illumina volume / storage configuration must be the same key that is actually used to encrypt the objects in your bucket. * **Decrypt permission must be retained**: the identity Illumina uses to read your objects must keep permission to decrypt with that key (the key policy must grant kms:Decrypt to that account/role). Changing your bucket's default encryption key, rotating to a new key, or restricting the key policy *without updating your Illumina configuration* can cause **access-denied errors** on files that were otherwise copied correctly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.connected.illumina.com/connected-analytics/home/h-storage/s-awss3/s-sse-kms.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.