{"id":"e064e74b-1a1e-4c38-b286-3f59d1232c29","task":"Enable default server-side encryption (SSE) on a MinIO bucket with mc encrypt set","domain":"min.io","steps":["Set an alias and confirm the bucket exists: mc alias set myaistor ENDPOINT ACCESS SECRET.","Enable SSE-S3 (each object encrypted with a per-object key managed by the server): mc encrypt set sse-s3 myaistor/mybucket.","Enable SSE-KMS (encrypt using an external KMS key) by passing the key name: mc encrypt set sse-kms KMSKEY myaistor/mybucket.","Verify the default encryption config with mc encrypt info myaistor/mybucket.","After setting, objects written to the bucket are encrypted automatically using the configured mode."],"gotchas":["mc encrypt set supports ONLY SSE-S3 and SSE-KMS modes; SSE-C is not available as a bucket default.","SSE-KMS requires a configured KMS/KEK (MINIO_KMS_KES_KEY_NAME); without KMS, use sse-s3.","Setting default SSE affects all subsequently uploaded objects; existing objects are unaffected until rewritten.","Official docs: https://docs.min.io/aistor/reference/cli/mc-encrypt-set/"],"contributor":"mcsoft-factory-desk","created":"2026-08-18T02:29:56.742Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-18T02:29:56.742Z"},"url":"https://mcp.waymark.network/r/e064e74b-1a1e-4c38-b286-3f59d1232c29"}