docs: document WEED_S3_SSE_KEY env var for SSE-S3 KEK

Add KEK configuration section to Server-Side-Encryption.md with
migration instructions. Add SSE-S3 encryption key section to
Environment-Variables.md.

Environment-Variables.md

@@ -79,6 +79,21 @@ WEED_HTTPS_CLIENT_KEY=/path/to/client.key
 WEED_HTTPS_CLIENT_CA=/path/to/ca.crt
 ```
 
+### SSE-S3 Encryption Key (KEK)
+```shell
+# Hex-encoded 256-bit key used as the Key Encryption Key for SSE-S3.
+# When set, the S3 API server uses this key instead of storing a KEK
+# on the filer at /etc/s3/sse_kek.
+WEED_S3_SSE_KEY=<64 hex chars>
+```
+
+Generate a key:
+```shell
+openssl rand -hex 32
+```
+
+See [[Server-Side-Encryption]] for details.
+
 For full details, see [[Security Configuration]].
 
 # Docker

Server-Side-Encryption.md

@@ -33,6 +33,7 @@ Use this quick guide to choose the right option:
 - **Keys live in**: SeaweedFS (we handle the key management for you)
 - **Why teams like it**: Works with explicit `x-amz-server-side-encryption: AES256` and bucket default encryption; supports multipart uploads and range requests
 - **Configuration**: Optional bucket-level default encryption via the standard S3 bucket encryption API
+- **Key Encryption Key (KEK)**: The recommended way to provide the KEK is via the `WEED_S3_SSE_KEY` environment variable (hex-encoded 256-bit key). This avoids storing the master key on the filer. See [KEK Configuration](#kek-configuration) below.
 
 ## Quick Start
 
@@ -116,6 +117,37 @@ weed s3 -config=s3_kms_config.json
 - Compatible with all S3 clients and SDKs
 - Same error codes and responses
 
+## KEK Configuration
+
+SSE-S3 uses envelope encryption: a Key Encryption Key (KEK) protects per-object Data Encryption Keys (DEKs). You can provide the KEK in two ways:
+
+### Recommended: Environment Variable
+
+Set `WEED_S3_SSE_KEY` to a hex-encoded 256-bit key:
+
+```bash
+# Generate a key
+export WEED_S3_SSE_KEY=$(openssl rand -hex 32)
+
+# Start the S3 API server
+weed s3 -filer=localhost:8888
+```
+
+The key never touches the filer filesystem. Store it in your secrets manager (Vault, AWS Secrets Manager, Kubernetes Secrets, etc.) and inject it as an environment variable at startup.
+
+### Legacy: Filer-Stored KEK (deprecated for new deployments)
+
+If `WEED_S3_SSE_KEY` is not set, SeaweedFS falls back to loading the KEK from `/etc/s3/sse_kek` on the filer. If that file doesn't exist either, a new key is auto-generated and saved there. This behavior is preserved for backward compatibility but is **deprecated for new deployments** because it stores the master key in plaintext on the filer.
+
+### Migration from Filer KEK to Environment Variable
+
+1. Read the existing KEK from the filer: `weed shell` → `fs.cat /etc/s3/sse_kek`
+2. Set the environment variable: `export WEED_S3_SSE_KEY=<value from step 1>`
+3. Restart the S3 API server — it will use the env var and skip the filer lookup
+4. Optionally remove the filer file once all S3 API servers are migrated
+
+> **Important:** The env var value and the filer-stored value use the same format (64 hex characters). Use the exact same key to keep existing encrypted objects readable.
+
 ## Implementation Notes
 
 - **SSE-KMS**: Supports AWS KMS, Google Cloud KMS, OpenBao/Vault; Azure Key Vault is available behind the `azurekms` build tag (experimental)