S3 Encryption at Rest
~8 min read
Three ways to encrypt S3 data, differing in who manages the keys.
S3 Encryption at Rest is a Pro topic
Sign in, then upgrade to Pro or Power to unlock this topic and the full AWS curriculum.
Key points
- •SSE-S3: AWS-managed keys, automatic, free, the sensible default
- •SSE-KMS: KMS-managed keys, audit trail via CloudTrail, fine-grained access control, small per-request cost
- •SSE-C: customer-supplied key, AWS never stores it, full responsibility (and risk) on the customer
- •Choice depends on compliance/audit needs, not on data sensitivity alone — all three encrypt the data at rest