GetBucketEncryption

GetBucketEncryption returns a bucket's default server-side encryption configuration: the encryption applied to new objects uploaded without an encryption header of their own. On STRG that default is server-side encryption with STRG-managed keys (AES256), so the answer is simple to read and always the same. PutBucketEncryption is its counterpart for setting it.

Good to know on STRG

• The answer is always AES256: we manage the keys for you, so there is no KMS key ID to return.
• A bucket that was never given a default answers 200 with AES256 as well, so a client never has to handle 404 ServerSideEncryptionConfigurationNotFoundError.
• x-amz-expected-bucket-owner is welcome and has nothing to check.

When you'd use it

• A security review asks whether data at rest is encrypted. An audit script goes through every bucket, calls GetBucketEncryption on each and records the AES256 answer as evidence.
• Infrastructure-as-code and backup tools often read a bucket's settings before working with it, encryption among them. STRG answers with the bucket's default, so they carry on as usual.
• An agent setting up a bucket for a new project calls PutBucketEncryption and then reads the configuration back to confirm it before reporting the bucket ready.

Request

GET /?encryption HTTP/1.1
Host: my-bucket.s3.eu-central-1.strg.com
Authorization: AWS4-HMAC-SHA256 Credential=...
x-amz-date: 20260926T120000Z
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Path-style, the same request is GET /my-bucket?encryption on s3.eu-central-1.strg.com. Addressing describes both styles.

Permissions

The access key needs Read encryption settings (bucket-encryption:read). A key limited to certain buckets can hold it too, and then reaches only those buckets. Access keys has the details.

URI parameters

Name	Type	Required	Description
Bucket	String	Yes	The bucket whose default encryption is read.
encryption	Flag	Yes	Selects the encryption subresource. Sent without a value.

Any other query parameter is answered 501 NotImplemented, so a client knows straight away that it has no effect here.

Request headers

Name	Type	Required	Description
x-amz-expected-bucket-owner	String	No	Welcome, and has nothing to check: an access key only ever reaches its own account's buckets.

Request body

None.

Response

A successful request answers 200 OK with the configuration as XML.

Response headers

Name	Description
x-amz-request-id	The request ID, for support requests.

Response body

The configuration holds one rule, and its elements are these.

Element	Type	Description
ServerSideEncryptionConfiguration	Container	The root element.
Rule	Container	One rule. STRG always returns exactly one.
ApplyServerSideEncryptionByDefault	Container	The default applied to new objects.
SSEAlgorithm	String	Always AES256: server-side encryption with STRG-managed keys. aws:kms and aws:kms:dsse never appear.
KMSMasterKeyID	String	Never returned: STRG manages the keys, so there is no KMS key to name.
BucketKeyEnabled	Boolean	Not used. Bucket keys belong to SSE-KMS, which STRG's managed keys make unnecessary.
BlockedEncryptionTypes	Container	Never returned. STRG has no setting for blocking encryption types.

<?xml version="1.0" encoding="UTF-8"?>
<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
  <Rule>
    <ApplyServerSideEncryptionByDefault>
      <SSEAlgorithm>AES256</SSEAlgorithm>
    </ApplyServerSideEncryptionByDefault>
  </Rule>
</ServerSideEncryptionConfiguration>

Errors

These are the errors this operation can answer, and the situation behind each.

Code	HTTP status	When
NoSuchBucket	404	The bucket does not exist, it is in a region other than the endpoint's, or your account has no storage in this endpoint's region yet.
AccessDenied	403	The access key lacks Read encryption settings, or is limited to buckets that do not include this one.
InvalidAccessKeyId	403	The access key does not exist, has expired or been revoked, or was created so recently that it is not yet usable in this endpoint's region - a moment later it is.
SignatureDoesNotMatch	403	The request signature is wrong.
RequestTimeTooSkewed	403	The request time is more than 15 minutes from the server's.
AuthorizationHeaderMalformed	400	The signature's credential scope names a region other than the endpoint's.
NotImplemented	501	The request carries a query parameter this operation does not accept.
SlowDown	503	Too many requests at once; a retry after the Retry-After interval goes through.
ServiceUnavailable	503	A temporary failure; a retry usually succeeds.

Differences from Amazon S3

A few things work a little differently on STRG, each listed here with what it means for your requests.

Aspect	Amazon S3	STRG
Algorithms	AES256 (SSE-S3), aws:kms, aws:kms:dsse	AES256, server-side encryption with STRG-managed keys - one answer, with no keys for you to manage
Bucket never configured	AES256, the S3 default	AES256 as well, never 404 ServerSideEncryptionConfigurationNotFoundError
BucketKeyEnabled, BlockedEncryptionTypes	Returned where set	Not part of the answer: neither setting exists on STRG
Bucket in another region	301 redirect with x-amz-bucket-region	404 NoSuchBucket. Each bucket answers on its own regional endpoint.
x-amz-expected-bucket-owner	Checked against the bucket owner	Welcome, with nothing to check: a key only ever reaches buckets of its own account

Examples

Each example reads the default encryption of my-bucket; the SDK examples print its algorithm.

AWS CLI

aws s3api get-bucket-encryption \
  --bucket my-bucket \
  --endpoint-url https://s3.eu-central-1.strg.com \
  --region eu-central-1

Python (boto3)

import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.eu-central-1.strg.com",
    region_name="eu-central-1",
)

response = s3.get_bucket_encryption(Bucket="my-bucket")
for rule in response["ServerSideEncryptionConfiguration"]["Rules"]:
    print(rule["ApplyServerSideEncryptionByDefault"]["SSEAlgorithm"])

JavaScript (AWS SDK v3)

import { GetBucketEncryptionCommand, S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://s3.eu-central-1.strg.com",
  region: "eu-central-1",
});

const response = await client.send(new GetBucketEncryptionCommand({ Bucket: "my-bucket" }));
for (const rule of response.ServerSideEncryptionConfiguration?.Rules ?? []) {
  console.log(rule.ApplyServerSideEncryptionByDefault?.SSEAlgorithm);
}

Related

• PutBucketEncryption - setting the default
• PutObject - per-object encryption headers
• Access keys
• S3 API overview