Data needs protecting in two places: where it is stored (at rest) and on its way there (in transit).
At rest
Every new object is encrypted on S3's disks by default, with keys S3 creates and rotates for you. This is SSE-S3, shown as AES256:
sh
aws s3api get-bucket-encryption --bucket market-docs-ucsduvsh
aws s3api head-object --bucket market-docs-ucsduv --key prices.csv --query ServerSideEncryptionThere are two other kinds, named here and taught later:
| Kind | Keys | When |
|---|---|---|
SSE-S3 (AES256) | S3 manages them | the default, fine for most data |
SSE-KMS (aws:kms) | a key in KMS that you control and audit | when you must decide who may decrypt (Chapter 11) |
| SSE-C | a key you send with every request | rare; you keep the keys |
In transit
Encryption in transit is HTTPS. The CLI and SDKs always use it, but a bucket also answers plain http://. A bucket policy can refuse that, with the condition key aws:SecureTransport:
json
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "HttpsOnly",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": ["arn:aws:s3:::market-docs-ucsduv", "arn:aws:s3:::market-docs-ucsduv/*"],
"Condition": { "Bool": { "aws:SecureTransport": "false" } }
}]
}A Deny with a condition, as in Chapter 2: it applies only to requests that did not use HTTPS, and wins over any Allow.