what is error 05-ENCRYPT0005-00000207 and how to fix it-Object Storage Service(OSS)-阿里云帮助中心

Problem description

The Customer Master Key (CMK) ID specified in the x-oss-server-side-encryption-key-id request header is disabled. This error occurs when you use a Bring-Your-Own-Key (BYOK) from Key Management Service (KMS) for server-side encryption.

Causes

The CMK ID specified in the x-oss-server-side-encryption-key-id request header is disabled.

Examples

For example, you can use a BYOK from KMS for server-side encryption. You upload your key to KMS to generate a CMK ID. When you upload data to OSS using operations such as PutObject, AppendObject, or InitMultipart, you set the x-oss-server-side-encryption header to KMS. To use your BYOK key, you must also include the x-oss-server-side-encryption-key-id header and specify an active CMK ID.

If you disable this CMK ID in the KMS console, OSS returns this error code when you try to access the object.

Solutions

When you use a BYOK from KMS for server-side encryption, set the x-oss-server-side-encryption header to KMS. You must also set the x-oss-server-side-encryption-key-id header to an active CMK ID.

References

For more information, see Server-side encryption.