Problem description
The customer master key (CMK) ID specified in the x-oss-server-side-encryption-key-id header is invalid. This error occurs during a server-side encryption request that uses a Bring-Your-Own-Key (BYOK) key from Key Management Service (KMS).
Causes
When you use a BYOK key from KMS for server-side encryption, the CMK ID specified in the x-oss-server-side-encryption-key-id header must exist in Alibaba Cloud KMS. OSS returns this error if the CMK ID cannot be found.
Examples
Suppose you use a BYOK key from KMS for server-side encryption. You import your key material into KMS to create a CMK and obtain its ID. When you upload data to OSS by using operations such as PutObject, AppendObject, or InitMultipart, you must set the x-oss-server-side-encryption header to KMS and set the x-oss-server-side-encryption-key-id header to an active CMK ID.
If the CMK ID cannot be found in KMS, this error is returned.
Solutions
To upload a server-side encrypted object by using a BYOK key from KMS, set the x-oss-server-side-encryption header to KMS and set the x-oss-server-side-encryption-key-id header to a valid CMK ID from Alibaba Cloud KMS.