0005-00000228

Problem description

Uploading an object returns an error after you set the x-oss-server-side-encryption-context request header, even though the bucket has server-side encryption using Key Management Service (SSE-KMS) configured.

Causes

x-oss-server-side-encryption-context is only valid in BYOK (Bring Your Own Key) scenarios — that is, when you supply your own KMS key by setting x-oss-server-side-encryption-key-id in the same request. OSS rejects any request that sets x-oss-server-side-encryption-context without x-oss-server-side-encryption-key-id.

Examples

A bucket has SSE-KMS configured with a KMS-managed key (non-BYOK). When uploading an object:

• x-oss-server-side-encryption-key-id is not set (non-BYOK scenario)

• x-oss-server-side-encryption-context is set

OSS rejects the request and returns an error because x-oss-server-side-encryption-context is not applicable in non-BYOK scenarios.

Solutions

Choose one of the following based on your intent:

• Remove the header: If you are using SSE-KMS with a KMS-managed key, remove the x-oss-server-side-encryption-context header from the request.

• Switch to BYOK: If you need to pass a custom encryption context, also set x-oss-server-side-encryption-key-id to your KMS key ID. Both headers are then valid together.