cloud37io/s3-encryption-gateway repository overview

⁠S3 Encryption Gateway

A transparent HTTP proxy that provides client-side encryption for any S3-compatible storage backend — without changing a single line of application code.

Point your existing S3 clients (CNPG, Velero, Loki, Seafile, Gitea, Terraform, ...) at the gateway instead of directly at S3. The gateway encrypts data on write and decrypts on read. Your S3 backend stores only ciphertext.

┌─────────────┐          ┌──────────────────────┐          ┌────────────────┐
│  S3 Client  │─S3 API─▶│  Encryption Gateway  │─S3 API─▶│  S3 Backend    │
│  (any app)  │◀────────│  encrypt / decrypt   │◀────────│  AWS, Hetzner, │
└─────────────┘ plain    └──────────────────────┘  cipher  │  Wasabi, B2... │
                 text                               text   └────────────────┘

⁠Quick Start

# Generate a 256-bit AES Key Encryption Key (keep this safe — it protects all your data)
openssl rand -base64 32

docker run -p 8080:8080 \
  -e BACKEND_ENDPOINT="https://s3.amazonaws.com" \
  -e BACKEND_REGION="us-east-1" \
  -e BACKEND_ACCESS_KEY="your-backend-key" \
  -e BACKEND_SECRET_KEY="your-backend-secret" \
  -e KEY_MANAGER_ENABLED=true \
  -e KEY_MANAGER_PROVIDER=self_contained \
  -e SELF_CONTAINED_TYPE=aes \
  -e SELF_CONTAINED_AES_KEYS="1=base64:<your-generated-kek>" \
  -e GW_ACCESS_KEY_1="gateway-access-key" \
  -e GW_SECRET_KEY_1="gateway-secret-key" \
  cloud37io/s3-encryption-gateway:latest

Point any S3 client at http://localhost:8080. Done.

⁠Available Tags

⁠Key Features

• Transparent: Any S3-compatible client works without modification
• Envelope encryption: Per-object DEKs wrapped with a KEK — 50–76× faster than password-derived keys
• AES-256-GCM (default) or ChaCha20-Poly1305 authenticated encryption
• FIPS-compliant image (-fips tag): restricts to FIPS 140-3 approved algorithms
• External KMS: Cosmian KMIP with key rotation and dual-read windows
• Encrypted multipart uploads: Large objects end-to-end encrypted via per-upload DEKs and HKDF-derived per-chunk IVs
• Range requests: Fetches only the encrypted chunks covering the requested byte range
• Kubernetes-native: Helm chart, ServiceMonitor, NetworkPolicy, Grafana dashboard

⁠Tested Backends

AWS S3 · Hetzner Object Storage · Wasabi · Backblaze B2 · Cloudflare R2 · MinIO · RustFS · Garage

⁠Configuration

All settings are available as environment variables or via a config.yaml file (mount at /app/config.yaml).

Full configuration reference: docs/⁠

⁠Kubernetes (Helm)

helm repo add s3-encryption-gateway https://cloud37.github.io/s3-encryption-gateway/
helm install s3-encryption-gateway s3-encryption-gateway/s3-encryption-gateway

Helm chart on Artifact Hub⁠.

⁠Links

• GitHub: https://github.com/cloud37/s3-encryption-gateway⁠
• Documentation: https://github.com/cloud37/s3-encryption-gateway/tree/main/docs⁠
• Helm Chart: https://artifacthub.io/packages/helm/s3-encryption-gateway/s3-encryption-gateway⁠
• Issues: https://github.com/cloud37/s3-encryption-gateway/issues⁠
• License: MIT

Built and maintained by cloud37⁠ — cloud consulting with offices in Switzerland, Germany, and Italy.