Let's quickly go through some important concepts related to S3 encryption:
- Data on S3 can be encrypted while at rest (stored on AWS disks) or in transit (moving to and from S3). Encryption at rest can be done using server-side encryption or by uploading encrypted data from the client.
- S3 server-side encryption techniques for data at rest use symmetric keys for encryption.
- Encryption of data in transit using SSL/TLS (HTTPS) uses asymmetric keys for encryption.
- S3 default encryption (available as bucket properties) provides a way to set the default encryption behavior for an S3 bucket with SSE-S3 or SSE-KMS. Enabling this property does not affect existing objects in our bucket, and applies only for new objects uploaded.