0005-00000207

Problem description

The Customer Master Key (CMK) ID specified in the x-oss-server-side-encryption-key-id request header is disabled. OSS returns this error when you use a Bring-Your-Own-Key (BYOK) from Key Management Service (KMS) for server-side encryption and the specified CMK has been disabled in KMS.

Causes

The CMK ID specified in x-oss-server-side-encryption-key-id is disabled. This error occurs during upload operations, including PutObject, AppendObject, and InitMultipart.

Examples

The following request triggers this error when the specified CMK ID has been disabled in KMS:

PUT /example-object.jpg HTTP/1.1
Host: my-bucket.oss-<region>.aliyuncs.com
x-oss-server-side-encryption: KMS
x-oss-server-side-encryption-key-id: <disabled-CMK-ID>

OSS returns an error response indicating that the CMK is disabled.

Solutions

To resolve this error, use one of the following approaches:

1. Re-enable the existing CMK in the KMS console, then retry the upload operation:

   1. Log on to the KMS console.

   2. Locate the CMK whose ID you specified in the x-oss-server-side-encryption-key-id header.

   3. Re-enable the CMK.

   4. Retry the upload operation.

2. Alternatively, update the x-oss-server-side-encryption-key-id header to use a different active CMK ID.

In both cases, ensure your request includes the following headers:

References

For more information, see Server-side encryption.