AWS Security Cookbook

Server-side encryption with S3-managed keys (SSE-S3)

We can upload an object from the console with SSE-S3 as follows:

1. Go to the S3 bucket.
2. Click Upload, click Add Files, select your file, and then click Next, selecting the defaults in the Set Properties tab.
3. In the Set Properties tab, scroll down and select Amazon S3 master key under Encryption. Follow the on-screen options to complete the upload. We can verify this from the object's properties:

It is important to note that, if we try to open or download the object, we will still be able to see the object as-is because S3 will decrypt the object using the same key.

We can change encryption ...