12 lines
1.0 KiB
Plaintext
12 lines
1.0 KiB
Plaintext
Server-side encryption (SSE) encrypts an object (not the metadata) as it is written to disk (where the S3 bucket resides) and decrypts it as it is read from disk. This doesn't change the way the objects are accessed, as long as the user has the necessary permissions, objects are retrieved as if they were unencrypted. Thus, SSE only helps in the event of disk thefts, improper disposals of disks and other attacks on the AWS infrastructure itself.
|
|
|
|
|
|
There are three SSE options:
|
|
|
|
* Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
|
|
** AWS manages encryption keys and the encryption itself (with AES-256) on its own.
|
|
* Server-Side Encryption with Customer Master Keys (CMKs) Stored in AWS Key Management Service (SSE-KMS)
|
|
** AWS manages the encryption (AES-256) of objects and encryption keys provided by the AWS KMS service.
|
|
* Server-Side Encryption with Customer-Provided Keys (SSE-C)
|
|
** AWS manages only the encryption (AES-256) of objects with encryption keys provided by the customer. AWS doesn't store the customer's encryption keys.
|