Encryption from existing Objects in Bucket

[Phyroks]

Is it possible to encrypt objects in a bucket retroactively after enabling bucket encryption?

[For8stt]

Afaik enabling bucket encryption is not retroactive.

It should apply only to new uploads / rewrites after encryption is enabled. Existing objects usually stay as they were until they are copied or re-uploaded.

So the usual way to “retroactively” encrypt them is to rewrite the objects, e.g. copy each object onto itself or copy them to another bucket with encryption enabled.

Something like:

# example idea, not tested against RustFS specifically
mc mirror source/bucket target/encrypted-bucket

or iterate over objects and re-copy them.

So imo:

• existing objects: not encrypted automatically
• new objects: encrypted after bucket encryption is enabled
• old objects need rewrite/copy to get encrypted

Would be good to confirm if RustFS has a built-in re-encrypt job, but I don’t think it happens automatically.