Encryption error when setting encryption bucket using mc encrypt set sse-kms

[casperair77-tech]

Currently, I'm using MC Client to set encryption for my bucket with the syntax mc encryption sse-kms alias/mybucket. The setting appears successful, but when I check the UI, it's still disabled, and checking the xl.meta file shows it's not encrypted.

However, when I enable encryption on the UI, everything works normally.

[overtrue]

I could not reproduce this on current main.

Tested with mc version RELEASE.2025-04-16T18-13-26Z, local KMS enabled, and:

mc encrypt set sse-kms rustfs-e2e-test-default-key rustfs3039/mybucket
mc encrypt info rustfs3039/mybucket
mc cp /tmp/rustfs3039-object.txt rustfs3039/mybucket/test.txt
mc stat --json rustfs3039/mybucket/test.txt

mc encrypt info reported SSE-KMS enabled, and mc stat returned X-Amz-Server-Side-Encryption: aws:kms plus X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id: rustfs-e2e-test-default-key. The existing SSE-KMS bucket-default e2e test also passes on current main.

Please share the exact mc command, mc --version, RustFS version/image tag, and whether RustFS was started with KMS enabled plus a default key id.

[cxymds]

The current result in the local beta.6 environment is:
The execution of mc encrypt set sse-kms local19000/issue3039 was successful.
mc encrypt info local19000/issue3039 returned "Auto encryption 'sse-s3' is enabled".
However, mc stat local19000/issue3039 displayed: Encryption:Key Type: SSE-KMS.
In the bucket settings page of the Console, the Overview card shows Encryption = aws:kms.
When opening the encryption editing pop-up, SSE-KMS is selected by default. The pop-up also requires selecting a KMS Key ID @overtrue

[overtrue]

Verified and fixed on current main.

Root cause: When mc encrypt set sse-kms <bucket> is called without a specific KMS key ID, the PutBucketEncryption request carries SSEAlgorithm=aws:kms but an empty KMSMasterKeyID. RustFS stored this as-is. When mc encrypt info later called GetBucketEncryption, the response contained the algorithm but no key ID. The mc client determines SSE-KMS vs SSE-S3 by checking whether KMSMasterKeyID is present (not by the algorithm string), so it displayed "sse-s3".

Fix: In execute_put_bucket_encryption, when SSE-KMS is configured without a specific key ID, the handler now queries the KMS service for the default key and populates KMSMasterKeyID before storing. This ensures GetBucketEncryption responses always include the key ID for SSE-KMS configs, matching the behavior expected by mc and other S3 clients.

Regression test: Added test_sse_kms_without_key_id_populates_default in bucket_default_encryption_test.rs — sets SSE-KMS without a key ID, then verifies GetBucketEncryption returns the default KMS key ID.