feat(tutorial): add tutorial to store sse-c key into secret manager

tutorials/object-storage-sse-c-with-secret-manager/index.mdx

@@ -0,0 +1,83 @@
+---
+meta:
+  title: Using Secret Manager to store encryption key for SSE-C
+  description: Learn how to use Secret Manager to store encryption key for Object Storage and SSE-C.
+content:
+  h1: Using Secret Manager to store encryption key for SSE-C
+  paragraph: Learn how to use Secret Manager to store encryption key for Object Storage and SSE-C.
+tags: object-storage secret-manager encryption
+categories:
+  - object-storage
+  - secret-manager
+  - key-manager
+dates:
+  validation: 2025-10-15
+  posted: 2025-10-15
+---
+import Requirements from '@macros/iam/requirements.mdx'
+
+In this tutorial you will learn how to use Key Manager and Secret Manager to generate and store an encryption key used with [SSE-C](/object-storage/api-cli/enable-sse-c/) to encrypt and decrypt objects stored in a Scaleway Object Storage bucket.
+
+<Requirements />
+
+- A Scaleway account logged into the [console](https://console.scaleway.com)
+- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
+- An [Object Storage bucket](/object-storage/how-to/create-a-bucket/)
+- Installed and initialized the [AWS CLI](/object-storage/api-cli/object-storage-aws-cli/)
+
+The goal here is to use Key Manager to generate the encryption key, store the encryption key in Secret Manager, then use it to encrypt Object Storage objects SSE-C.
+
+## Generating the encryption key
+
+Run the following commands to create a key in Key Manager, generate the encryption key, then store it in Secret Manager.
+
+```bash
+KEY_ID=$(scw keymanager key create -o template="{{.ID}}")
+scw keymanager key generate-data-key "$KEY_ID" -o json | jq -r .plaintext | base64 -d > ssec.key
+SECRET_ID=$(scw secret secret create name=ssec-key path=/keys -o template="{{.ID}}")
+scw secret version create "$SECRET_ID" data="@ssec.key"
+```
+
+## Preparing the encryption key and its digest
+
+Run the following command to access the secret version to get the encryption key, encode it to base64, calculate the MD5 digest of the key (also encoded in base64), and store the outputs in environment variables. 
+
+```bash
+scw secret version access "$SECRET_ID" revision=latest raw=true > ssec.key
+ENCRYPTION_KEY=$(cat ssec.key | base64)
+KEY_DIGEST=$(openssl dgst -md5 -binary ssec.key | base64)
+```
+
+<Message type="important">
+If you delete the secret containing the encryption key, you also lose the data encrypted with it, as you will not be able to perform `GET` operations on encrypted objects without the corresponding key.
+</Message>
+
+### Upload and download object with SSE-C
+
+1. Run the command below to upload an object and encrypt it. Make sure to replace `<your-bucket-name>`, `<your-object-key>`, and `<path/to/your/file>` with the correct values.
+
+    ```bash
+    aws s3api put-object \
+      --bucket <your-bucket-name> \
+      --key <your-object-key> \
+      --body <path/to/your/file> \
+      --sse-customer-algorithm AES256 \
+      --sse-customer-key $ENCRYPTION_KEY \
+      --sse-customer-key-md5 $KEY_DIGEST
+    ```
+
+2. Run the command below to download the previously uploaded object and decrypt it. Make sure to replace `<your-bucket-name>`, `<your-object-key>`, and `<path/to/destination/file>` with the correct values.
+
+    ```bash
+    aws s3api get-object \
+      --bucket <your-bucket-name> \
+      --key <your-object-key> \
+      <path/to/destination/file> \
+      --sse-customer-algorithm AES256 \
+      --sse-customer-key $ENCRYPTION_KEY \
+      --sse-customer-key-md5 $KEY_DIGEST
+    ```
+
+You can now use Key Manager and Secret Manager to safely create and store an encryption key to secure your Object Storage deployment with SSE-C.
+
+Refer to the [dedicated documentation](/object-storage/api-cli/enable-sse-c/) for more information on how to use SSE-C for Scaleway Object Storage.