Compression FileEncrypt
CertifiedEncrypt a file with AES-256
Compression FileEncrypt
Encrypt a file with AES-256
Default PBKDF2_SHA256 is OpenSSL-compatible (openssl enc -aes-256-cbc -pbkdf2).
Other KDFs use authenticated AES-GCM with a KESTRAENC file format.
type: io.kestra.plugin.compress.FileEncryptExamples
id: file_encrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: encrypt
type: io.kestra.plugin.compress.FileEncrypt
from: "{{ inputs.file }}"
password: "{{ secret('ENCRYPTION_PASSWORD') }}"
Encrypt with Argon2id (memory-hard, GPU-resistant)
id: file_encrypt_argon2id
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: encrypt
type: io.kestra.plugin.compress.FileEncrypt
from: "{{ inputs.file }}"
password: "{{ secret('ENCRYPTION_PASSWORD') }}"
keyDerivation: ARGON2ID
argon2TimeCost: 3
memory: 65536
parallelism: 1
Encrypt with Scrypt
id: file_encrypt_scrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: encrypt
type: io.kestra.plugin.compress.FileEncrypt
from: "{{ inputs.file }}"
password: "{{ secret('ENCRYPTION_PASSWORD') }}"
keyDerivation: SCRYPT
memory: 65536
parallelism: 1
Properties
from *string
Source file URI
Pebble expression referencing an Internal Storage URI e.g. {{ outputs.mytask.uri }}.
password *string
Password
argon2TimeCost integerstring
3Argon2id time cost
Number of passes over the memory buffer for Argon2id. RFC 9106 recommends 2-4. Default 3. Used only when keyDerivation is ARGON2ID; ignored otherwise.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150iterations integerstring
600000PBKDF2 iteration count
PBKDF2 number of hashing rounds (min 100000, default 600000). Used only by PBKDF2_SHA256 and PBKDF2_SHA512. Ignored for Argon2id (use argon2TimeCost), Scrypt (uses memory only), and when decrypting KESTRAENC files (read from the file header).
keyDerivation string
PBKDF2_SHA256PBKDF2_SHA256PBKDF2_SHA512ARGON2IDSCRYPTKey derivation function
PBKDF2_SHA256 (default): OpenSSL-compatible, no integrity check. PBKDF2_SHA512, ARGON2ID, SCRYPT: authenticated (AES-GCM).
memory integerstring
65536Memory cost
Argon2id: memory in KB. Scrypt: N (power of 2). Ignored for PBKDF2.
parallelism integerstring
1Parallelism
Argon2id threads or Scrypt p. Ignored for PBKDF2.
Outputs
uri string
uriEncrypted file URI
