Difference between revisions of "AWS S3 encryption"

Revision as of 04:08, 23 May 2024

Encryption (2017) is supported in AWS S3 (default Advanced Encryption Standard (AES 256bit) since January 5, 2023 all new objects are encrypted by default ^[1].

In transit (SSL/TLS)
At rest:
- Server Side Encryption (SSE):
- S3 Managed Keys (SSE-S3; 256bit);
- AWS Key Management Service, Managed Keys (SSE-KMS)
- Server Side Encryption with Customer Provided Keys (SSE-C)
Client Side Encryption: user encrypts data and use AWS S3 to store it

@@ Line 1: / Line 1: @@
+[[AWS S3 encryption|Encryption]] (2017) is supported in AWS S3 (default [[Advanced Encryption Standard]] (AES 256bit) since January 5, 2023 all new objects are encrypted by default <ref>https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html</ref>.
-[[AWS S3 encryption|Encryption]] (2017) is supported in AWS S3 (default [[Advanced Encryption Standard]] (AES) 256bit)
 *In [[transit]] ([[SSL]]/[[TLS]])
 *At [[rest]]:
 ** [[Server Side Encryption]] (SSE):
-**S3 Managed Keys (SSE-S3; 256bit);
+** [[S3 Managed Keys]] (SSE-S3; 256bit);
-**[[AWS Key Management Service]], Managed Keys (SSE-KMS)
+** [[AWS Key Management Service]], Managed Keys (SSE-KMS)
-**Server Side Encryption with Customer Provided Keys (SSE-C)
+** Server Side Encryption with Customer Provided Keys (SSE-C)
-* Client Side Encryption (user encypts data on their local machine and then upload to AWS S3)
+* [[Client Side Encryption]]: user encrypts data and use AWS S3 to store it
 == Related ==
-* [[aws s3api get-bucket-encryption]]
+* <code>[[aws s3api get-bucket-encryption]]</code> command
+* [[Terraform S3 resources]]: <code>[[aws_s3_bucket_server_side_encryption_configuration]]</code>
 == See also ==