This page explains how to deploy MinIO AIStor with KES for Server Side Encryption. For instructions on running KES, see the KES docs. Broadly, the required steps are: Create a new external key (EK) for server-side encryption (SSE). Create or modify an MinIO AIStor deployment to support SSE with KES. Configure automatic bucket-default SSE. Enabling SSE on an MinIO AIStor deployment automatically encrypts the backend data for that deployment using the default encryption key.