0005-00000203

Problem description

This error occurs when you create a bucket inventory and specify server-side encryption with Key Management Service (SSE-KMS) for the manifest file, or when you configure KMS encryption for a bucket and set the KMSDataEncryption option to a value other than SM4.

Causes

The customer master key (CMK) specified for KMS encryption in the PutBucketInventory request is not a symmetric key.

The bucket is configured to use KMS encryption, but the KMSDataEncryption option is set to a value other than SM4.

Examples

PUT /?encryption HTTP/1.1
Date: Thur, 5 Nov 2020 11:09:13 GMT
Content-Length: ContentLength
Content-Type: application/xml
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization: OSS qn6q**************:77Dv****************
<?xml version="1.0" encoding="UTF-8"?>
<ServerSideEncryptionRule>
  <ApplyServerSideEncryptionByDefault>
    <SSEAlgorithm>KMS</SSEAlgorithm>
    <KMSDataEncryption>abc</KMSDataEncryption>
    <KMSMasterKeyID></KMSMasterKeyID>
  </ApplyServerSideEncryptionByDefault>
</ServerSideEncryptionRule>

The request fails because ServerSideEncryptionRule/ApplyServerSideEncryptionByDefault/KMSDataEncryption is set to abc, which is an invalid value.

Solutions

• When you create a bucket inventory, specify a symmetric customer master key (CMK) if you use server-side encryption with Key Management Service (SSE-KMS) to encrypt the manifest file.

• When you configure KMS encryption for a bucket, you can omit the KMSDataEncryption option. By default, objects are encrypted with the AES256 algorithm. You can also set this option to SM4 to use the SM4 algorithm.

References

• Server-side encryption

• PutBucketEncryption

• PutBucketInventory