0005-00000204

Problem description

The KMSMasterKeyID parameter is specified, but the SSEAlgorithm bucket encryption algorithm is not set to KMS.

Problem cause

The KMSMasterKeyID parameter is valid only when the SSEAlgorithm encryption algorithm is set to KMS.

Example

PUT /?encryption HTTP/1.1
Date: Thur, 5 Nov 2020 11:09:13 GMT
Content-Length: ContentLength
Content-Type: application/xml
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization: OSS qn6q**************:77Dv****************
<?xml version="1.0" encoding="UTF-8"?>
<ServerSideEncryptionRule>
  <ApplyServerSideEncryptionByDefault>
    <SSEAlgorithm>AES256</SSEAlgorithm>
    <KMSMasterKeyID>9468da86-3509-4f8d-a61e-6eab1eac****</KMSMasterKeyID>
  </ApplyServerSideEncryptionByDefault>
</ServerSideEncryptionRule>

In this request, SSEAlgorithm is set to AES256, but KMSMasterKeyID is also specified in the ServerSideEncryptionRule/ApplyServerSideEncryptionByDefault node. The request is rejected because KMSMasterKeyID applies only to KMS encryption.

Solution

Do not specify KMSMasterKeyID for encryption types other than KMS. Remove this element from the request.

References

• Server-side encryption

• PutBucketEncryption