Chapter 5.8 - Encrypting S3 Objects

Question 1

What are the 3 types of encryption are used in S3?

Answer 1

** Encryption in Transit **
SSL / TLS - Secure Sockets Layer / Transport Layer Security
HTTPS - Hypertext Transfer Protocol Secure

** Encryption at Rest: Server-Side Encryption **
SSE-S3: S3-managed keys, using AES 256-bit encryption
SSE-KMS: AWS Key Management Service-managed keys
SSE-C: Customer-provided keys

** Encryption at Rest: Client-Side Encryption **
You encrypt the files yourself before you upload them to S3

Question 2

How is server-side encryption enforced in AWS S3?

Answer 2

** Console **
Select the encryption setting on your S3 bucket.
The easiest way. Checkbox in the console.

** Bucket Policy **
Enforce using a bucket policy.
Policy can include denial of any S3 PUT request that doesn’t include encrypted objects / the encryption parameter in the PUT request header.