Skip to content

Commit 11606c3

Browse files
committed
docs: split commands in ordered list with dedicated comments
1 parent 0d3fae7 commit 11606c3

File tree

1 file changed

+40
-11
lines changed
  • tutorials/object-storage-sse-c-with-secret-manager

1 file changed

+40
-11
lines changed

tutorials/object-storage-sse-c-with-secret-manager/index.mdx

Lines changed: 40 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -31,22 +31,51 @@ The goal here is to use Key Manager to generate the encryption key, store the en
3131

3232
Run the following commands to create a key in Key Manager, generate the encryption key, then store it in Secret Manager.
3333

34-
```bash
35-
KEY_ID=$(scw keymanager key create -o template="{{.ID}}")
36-
scw keymanager key generate-data-key "$KEY_ID" -o json | jq -r .plaintext | base64 -d > ssec.key
37-
SECRET_ID=$(scw secret secret create name=ssec-key path=/keys -o template="{{.ID}}")
38-
scw secret version create "$SECRET_ID" data="@ssec.key"
39-
```
34+
1. Create a key on the Key Manager
35+
36+
```bash
37+
KEY_ID=$(scw keymanager key create -o template="{{.ID}}")
38+
```
39+
40+
2. Generate the data encryption key
41+
42+
```bash
43+
scw keymanager key generate-data-key "$KEY_ID" -o json | jq -r .plaintext | base64 -d > ssec.key
44+
```
45+
46+
3. Create a secret in the Secret manager to store the data encryption key
47+
48+
```bash
49+
SECRET_ID=$(scw secret secret create name=ssec-key path=/keys -o template="{{.ID}}")
50+
```
51+
52+
4. Store the data encryption key
53+
54+
```bash
55+
scw secret version create "$SECRET_ID" data="@ssec.key"
56+
```
4057

4158
## Preparing the encryption key and its digest
4259

4360
Run the following command to access the secret version to get the encryption key, encode it to base64, calculate the MD5 digest of the key (also encoded in base64), and store the outputs in environment variables.
4461

45-
```bash
46-
scw secret version access "$SECRET_ID" revision=latest raw=true > ssec.key
47-
ENCRYPTION_KEY=$(cat ssec.key | base64)
48-
KEY_DIGEST=$(openssl dgst -md5 -binary ssec.key | base64)
49-
```
62+
1. Accessing the raw key
63+
64+
```bash
65+
scw secret version access "$SECRET_ID" revision=latest raw=true > ssec.key
66+
```
67+
68+
2. Serialize it to base64
69+
70+
```bash
71+
ENCRYPTION_KEY=$(cat ssec.key | base64)
72+
```
73+
74+
3. Compute the MD5 digest
75+
76+
```bash
77+
KEY_DIGEST=$(openssl dgst -md5 -binary ssec.key | base64)
78+
```
5079

5180
<Message type="important">
5281
If you delete the secret containing the encryption key, you also lose the data encrypted with it, as you will not be able to perform `GET` operations on encrypted objects without the corresponding key.

0 commit comments

Comments
 (0)