Does Velero support SSE AES256 or KMS for snapshots in AWS?

[joscabmar]

So far I was able to achieve SSE in the objects backup in S3. But I was not able to get the snapshots encrypted. I tried with the serverSideEncryption: AES256 parameter in the config, but it was not accepted:

time="2022-09-08T10:28:27Z" level=info msg="Processing item" backup=backups/testing-encrypted-snapshots-4 logSource="pkg/backup/backup.go:340" name=pvc-faee4793-414e-4af0-b87d-e9338f684b6b namespace= progress= resource=persistentvolumes
time="2022-09-08T10:28:27Z" level=info msg="Backing up item" backup=backups/testing-encrypted-snapshots-4 logSource="pkg/backup/item_backupper.go:123" name=pvc-faee4793-414e-4af0-b87d-e9338f684b6b namespace= resource=persistentvolumes
time="2022-09-08T10:28:27Z" level=info msg="Executing takePVSnapshot" backup=backups/testing-encrypted-snapshots-4 logSource="pkg/backup/item_backupper.go:396" name=pvc-faee4793-414e-4af0-b87d-e9338f684b6b namespace= resource=persistentvolumes
time="2022-09-08T10:28:27Z" level=error msg="Error getting volume snapshotter for volume snapshot location" backup=backups/testing-encrypted-snapshots-4 error="rpc error: code = Unknown desc = config has invalid keys [serverSideEncryption]; valid keys are [region profile credentialsFile enableSharedConfig]" error.file="/go/pkg/mod/github.com/vmware-tanzu/[email protected]/pkg/plugin/framework/validation.go:50" error.function=github.com/vmware-tanzu/velero/pkg/plugin/framework.validateConfigKeys logSource="pkg/backup/item_backupper.go:453" name=pvc-faee4793-414e-4af0-b87d-e9338f684b6b namespace= persistentVolume=pvc-faee4793-414e-4af0-b87d-e9338f684b6b resource=persistentvolumes volumeSnapshotLocation=default
time="2022-09-08T10:28:27Z" level=info msg="Persistent volume is not a supported volume type for snapshots, skipping." backup=backups/testing-encrypted-snapshots-4 logSource="pkg/backup/item_backupper.go:473" name=pvc-faee4793-414e-4af0-b87d-e9338f684b6b namespace= persistentVolume=pvc-faee4793-414e-4af0-b87d-e9338f684b6b resource=persistentvolumes

I could not find in the documentation any hint on how to configure it. I wonder if it is supported.

[LukasKnuth]

From my (limited) understanding:

The documentation thats available on this is the definition of the VolumeSnapshotLocaiton here: https://github.com/vmware-tanzu/velero-plugin-for-aws/blob/main/volumesnapshotlocation.md

This does not contain anything mentioning SSE, as opposed to the BackupStorageLocation, which does mention it: https://github.com/vmware-tanzu/velero-plugin-for-aws/blob/main/backupstoragelocation.md

[joscabmar]

Yes, that is what I saw when reading the documentation. I just wanted to confirm if it is indeed not supported.

[joscabmar]

I provided my solution in #5326 (comment)