AWS S3 encryption

Encryption (2017) is supported in AWS S3 (default Advanced Encryption Standard (AES 256bit) since January 5, 2023 all new objects are encrypted by default .

• In transit (SSL/TLS)
• At rest:
  • Server Side Encryption (SSE):
  • S3 Managed Keys (SSE-S3; 256bit);
  • AWS Key Management Service, Managed Keys (SSE-KMS)
  • Server Side Encryption with Customer Provided Keys (SSE-C)
• Client Side Encryption: user encrypts data and use AWS S3 to store it

Commands

• aws s3api get-bucket-encryption
• aws s3api put-bucket-encryption

Related

• Terraform S3 resources: aws_s3_bucket_server_side_encryption_configuration
• AWS S3 encryption

See also

• AWS S3 encryption: put-bucket-encryption
• AWS S3: s3api | list-buckets | get-bucket-website | get-bucket-policy | create-bucket | put-bucket-encryption | aws s3api put-bucket-policy | get-bucket-acl | get-bucket-versioning | get-bucket-location | put-bucket-versioning | get-bucket-tagging | head-bucket | put-object-lock-configuration

https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html