# GetBucketEncryption

GetBucketEncryption returns a bucket's default server-side encryption configuration: the
encryption applied to new objects uploaded without an encryption header of their own. On STRG
that default is server-side encryption with STRG-managed keys (`AES256`), so the answer is
simple to read and always the same. [PutBucketEncryption](https://docs.strg.com/s3-api/PutBucketEncryption) is its
counterpart for setting it.

**Info: Good to know on STRG**

- The answer is always `AES256`: we manage the keys for you, so there is no KMS key ID to return.
- A bucket that was never given a default answers `200` with `AES256` as well, so a client never
  has to handle `404 ServerSideEncryptionConfigurationNotFoundError`.
- `x-amz-expected-bucket-owner` is welcome and has nothing to check.

## When you'd use it

- A security review asks whether data at rest is encrypted. An audit script goes through every
  bucket, calls GetBucketEncryption on each and records the `AES256` answer as evidence.
- Infrastructure-as-code and backup tools often read a bucket's settings before working with it,
  encryption among them. STRG answers with the bucket's default, so they carry on as usual.
- An agent setting up a bucket for a new project calls
  [PutBucketEncryption](https://docs.strg.com/s3-api/PutBucketEncryption) and then reads the configuration back to
  confirm it before reporting the bucket ready.

## Request

```http
GET /?encryption HTTP/1.1
Host: my-bucket.s3.eu-central-1.strg.com
Authorization: AWS4-HMAC-SHA256 Credential=...
x-amz-date: 20260926T120000Z
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
```

Path-style, the same request is `GET /my-bucket?encryption` on `s3.eu-central-1.strg.com`.
[Addressing](https://docs.strg.com/s3-api/overview#addressing) describes both styles.

### Permissions

The access key needs **Read encryption settings** (`bucket-encryption:read`). A key limited to
certain buckets can hold it too, and then reaches only those buckets.
[Access keys](https://docs.strg.com/access-keys) has the details.

### URI parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Bucket` | String | Yes | The bucket whose default encryption is read. |
| `encryption` | Flag | Yes | Selects the encryption subresource. Sent without a value. |

Any other query parameter is answered `501 NotImplemented`, so a client knows straight away that
it has no effect here.

### Request headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `x-amz-expected-bucket-owner` | String | No | Welcome, and has nothing to check: an access key only ever reaches its own account's buckets. |

### Request body

None.

## Response

A successful request answers `200 OK` with the configuration as XML.

### Response headers

| Name | Description |
| --- | --- |
| `x-amz-request-id` | The request ID, for support requests. |

### Response body

The configuration holds one rule, and its elements are these.

| Element | Type | Description |
| --- | --- | --- |
| `ServerSideEncryptionConfiguration` | Container | The root element. |
| `Rule` | Container | One rule. STRG always returns exactly one. |
| `ApplyServerSideEncryptionByDefault` | Container | The default applied to new objects. |
| `SSEAlgorithm` | String | Always `AES256`: server-side encryption with STRG-managed keys. `aws:kms` and `aws:kms:dsse` never appear. |
| `KMSMasterKeyID` | String | Never returned: STRG manages the keys, so there is no KMS key to name. |
| `BucketKeyEnabled` | Boolean | Not used. Bucket keys belong to SSE-KMS, which STRG's managed keys make unnecessary. |
| `BlockedEncryptionTypes` | Container | Never returned. STRG has no setting for blocking encryption types. |

```xml
<?xml version="1.0" encoding="UTF-8"?>
<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
  <Rule>
    <ApplyServerSideEncryptionByDefault>
      <SSEAlgorithm>AES256</SSEAlgorithm>
    </ApplyServerSideEncryptionByDefault>
  </Rule>
</ServerSideEncryptionConfiguration>
```

## Errors

These are the errors this operation can answer, and the situation behind each.

| Code | HTTP status | When |
| --- | --- | --- |
| `NoSuchBucket` | 404 | The bucket does not exist, it is in a region other than the endpoint's, or your account has no storage in this endpoint's region yet. |
| `AccessDenied` | 403 | The access key lacks **Read encryption settings**, or is limited to buckets that do not include this one. |
| `InvalidAccessKeyId` | 403 | The access key does not exist, has expired or been revoked, or was created so recently that it is not yet usable in this endpoint's region - a moment later it is. |
| `SignatureDoesNotMatch` | 403 | The request signature is wrong. |
| `RequestTimeTooSkewed` | 403 | The request time is more than 15 minutes from the server's. |
| `AuthorizationHeaderMalformed` | 400 | The signature's credential scope names a region other than the endpoint's. |
| `NotImplemented` | 501 | The request carries a query parameter this operation does not accept. |
| `SlowDown` | 503 | Too many requests at once; a retry after the `Retry-After` interval goes through. |
| `ServiceUnavailable` | 503 | A temporary failure; a retry usually succeeds. |

## Differences from Amazon S3

A few things work a little differently on STRG, each listed here with what it means for your
requests.

| Aspect | Amazon S3 | STRG |
| --- | --- | --- |
| Algorithms | `AES256` (SSE-S3), `aws:kms`, `aws:kms:dsse` | `AES256`, server-side encryption with STRG-managed keys - one answer, with no keys for you to manage |
| Bucket never configured | `AES256`, the S3 default | `AES256` as well, never `404 ServerSideEncryptionConfigurationNotFoundError` |
| `BucketKeyEnabled`, `BlockedEncryptionTypes` | Returned where set | Not part of the answer: neither setting exists on STRG |
| Bucket in another region | `301` redirect with `x-amz-bucket-region` | `404 NoSuchBucket`. Each bucket answers on its own regional endpoint. |
| `x-amz-expected-bucket-owner` | Checked against the bucket owner | Welcome, with nothing to check: a key only ever reaches buckets of its own account |

## Examples

Each example reads the default encryption of `my-bucket`; the SDK examples print its algorithm.

**AWS CLI**

```bash
aws s3api get-bucket-encryption \
  --bucket my-bucket \
  --endpoint-url https://s3.eu-central-1.strg.com \
  --region eu-central-1
```

**Python (boto3)**

```python
import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.eu-central-1.strg.com",
    region_name="eu-central-1",
)

response = s3.get_bucket_encryption(Bucket="my-bucket")
for rule in response["ServerSideEncryptionConfiguration"]["Rules"]:
    print(rule["ApplyServerSideEncryptionByDefault"]["SSEAlgorithm"])
```

**JavaScript (AWS SDK v3)**

```javascript
import { GetBucketEncryptionCommand, S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://s3.eu-central-1.strg.com",
  region: "eu-central-1",
});

const response = await client.send(new GetBucketEncryptionCommand({ Bucket: "my-bucket" }));
for (const rule of response.ServerSideEncryptionConfiguration?.Rules ?? []) {
  console.log(rule.ApplyServerSideEncryptionByDefault?.SSEAlgorithm);
}
```

## Related

- [PutBucketEncryption](https://docs.strg.com/s3-api/PutBucketEncryption) - setting the default
- [PutObject](https://docs.strg.com/s3-api/PutObject) - per-object encryption headers
- [Access keys](https://docs.strg.com/access-keys)
- [S3 API overview](https://docs.strg.com/s3-api/overview)