How to Use Server-Side Encryption with the Backblaze B2 Command-Line Tool

Backblaze B2 Cloud Storage automatically encrypts newly uploaded and copied object data at rest using Server-Side Encryption with Backblaze-managed keys (SSE-B2) and AES-256 when a request does not specify SSE-C. You do not need to enable a bucket setting, change an existing CLI command, or add --sse AES256 to receive this protection.

The default applies immediately to new buckets. Existing buckets receive the default gradually.

For more information, see Server-Side Encryption.

For information about using server-side encryption with the B2 Native API, see Use Server-Side Encryption with the B2 Native API.

For all Backblaze API operations and their corresponding documentation, see API Documentation.

Upload Files with SSE-B2

SSE-B2 is applied automatically when a request does not specify SSE-C. The --sse AES256 option is not required, but you can include it to request SSE-B2 explicitly.

aws s3 cp /path/to/myfile s3://mybucket/myfile --sse AES256 \    --endpoint-url <S3 endpoint>

Upload Files with SSE-C

To use a customer-provided AES-256 encryption key for an individual object, include the SSE-C options. SSE-C takes precedence over SSE-B2.

aws s3 cp /path/to/myfile s3://mybucket/myfile --sse-c AES256 \  --sse-c-key <AES256 KEY> --endpoint-url <S3 endpoint>