Encryption options with S3
S3 allows encryption at rest for the objects it stores. The default option when you store an object is to store it unencrypted. If you are working in any kind of environment that requires compliance, then you will most likely need to encrypt the objects you are storing.
If you have decided that your objects stored in S3 need to be encrypted, then you do have options. You can choose between server-side encryption and client-side encryption. There are some key questions to ask before making this decision:
- Do you need to manage the encryption key?
- Where is the encryption key going to be stored?
- Who is going to do the encryption and decryption of the data?
Server-side encryption
AWS has made the process of encrypting your objects and data in S3 storage easy with their server-side encryption options:
SSE-S3: Using theSSE-S3option allows you to use the AWS S3 master key to encrypt your objects and data. This allows your data...