RS: SSE-C - #3883
Open
kaitlynmichael wants to merge 1 commit into
Open
Conversation
Contributor
Contributor
Contributor
🧠 Redis MemoryFound 5 related items from repository history (5 new this commit):
Memory updated at 02afd59 |
dwdougherty
approved these changes
Aug 27, 2026
dwdougherty
left a comment
dwdougherty
left a comment
Collaborator
There was a problem hiding this comment.
I corrected a few relref specs. I'll go ahead and approve.
| ``` | ||
|
|
||
| - `sse_customer_key` must be a base64-encoded string that decodes to exactly 32 bytes (AES-256). | ||
| - SSE-C encryption is only available for S3 and S3-compatible storage locations, and only for this one export request. You can't add `encryption` to a database's persisted [backup_location]({{<relref "/operate/rs/references/rest-api/objects/bdb/backup_location">}}) configuration, so SSE-C isn't available for [scheduled backups]({{<relref "/operate/rs/databases/import-export/schedule-backups.md">}}). |
Collaborator
There was a problem hiding this comment.
Suggested change
| - SSE-C encryption is only available for S3 and S3-compatible storage locations, and only for this one export request. You can't add `encryption` to a database's persisted [backup_location]({{<relref "/operate/rs/references/rest-api/objects/bdb/backup_location">}}) configuration, so SSE-C isn't available for [scheduled backups]({{<relref "/operate/rs/databases/import-export/schedule-backups.md">}}). | |
| - SSE-C encryption is only available for S3 and S3-compatible storage locations, and only for this one export request. You can't add `encryption` to a database's persisted [backup_location]({{<relref "/operate/rs/references/rest-api/objects/bdb/backup_location">}}) configuration, so SSE-C isn't available for [scheduled backups]({{<relref "/operate/rs/databases/import-export/schedule-backups">}}). |
| Replace `<filepath>` with the location of the S3 CA certificate `ca.pem`. | ||
|
|
||
| {{< note >}} | ||
| Customer-provided encryption keys (SSE-C) aren't supported for scheduled backups. SSE-C is only available for on-demand [export]({{< relref "/operate/rs/databases/import-export/export-data.md" >}}) and [import]({{< relref "/operate/rs/databases/import-export/import-data.md" >}}) requests. |
Collaborator
There was a problem hiding this comment.
Suggested change
| Customer-provided encryption keys (SSE-C) aren't supported for scheduled backups. SSE-C is only available for on-demand [export]({{< relref "/operate/rs/databases/import-export/export-data.md" >}}) and [import]({{< relref "/operate/rs/databases/import-export/import-data.md" >}}) requests. | |
| Customer-provided encryption keys (SSE-C) aren't supported for scheduled backups. SSE-C is only available for on-demand [export]({{< relref "/operate/rs/databases/import-export/export-data" >}}) and [import]({{< relref "/operate/rs/databases/import-export/import-data" >}}) requests. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Low Risk
Documentation-only changes with no runtime or API implementation in this diff; risk is limited to doc accuracy and customer key-handling guidance.
Overview
Documents customer-provided S3 encryption (SSE-C) for Redis Software on-demand export and import over S3 and S3-compatible storage.
The docs add optional
encryptionobjects (type:"sse-c",sse_customer_keyas base64-encoded 32-byte AES-256 key) onexport_locationand S3 entries indataset_import_sources, with JSON examples in the how-to pages and REST API reference (backup_location,dataset_import_sources, export/import actions).They also state that SSE-C is request-scoped only: it works on export/import action requests and must not be stored in persisted
backup_locationordataset_import_sources(requests fail if you try). Scheduled backups explicitly do not support SSE-C, with a note on the schedule-backups page linking to on-demand export/import.Reviewed by Cursor Bugbot for commit 02afd59. Bugbot is set up for automated code reviews on this repo. Configure here.