An identity with write access may store or re-encrypt objects using a customer-provided key that the service does not retain, or a key held in a key management service outside the organization's control. The service then holds ciphertext it cannot decrypt on the organization's behalf, so the plaintext is available only to the holder of the foreign key. This results in a loss of availability of the affected data and, where the key holder is external, a loss of confidentiality.
Objects are Encrypted with Keys Outside Organizational Control
CCC.ObjStor.TH04
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.CP05 | Store New Objects | The service always allows a user to store a new object in a bucket under a key that is not yet in use. |
| CCC.ObjStor.CP06 | Replace Stored Objects | The service always allows a user to replace an object in a bucket by writing a new object to the same key, overwriting the previous content unless versioning retains it. |
| CCC.ObjStor.CP14 | Customer-Provided Encryption Keys | The service can encrypt an object at rest with a key that the user supplies in each request and that the service does not retain, as distinct from a key referenced from a key management service, so the object can only be read by presenting the same key again. |
| CCC.Core.CP35 | Customer-Managed Encryption Keys | The service may be configured to encrypt data at rest using a key that the user creates and controls in a key management service, instead of a key managed by the provider. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.CN01 | Prevent Requests to Buckets or Objects with Untrusted KMS Keys | Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption, or sensitive data decryption. |