Amazon S3 Server-Side Encryption with S3-Managed Keys – SSE-S3.pptx
- 2. AWS S3 Encryption • AWS S3 Encryption supports both data at rest and data in transit encryption. • Data in-transit • S3 allows protection of data in transit by enabling communication via SSL or using client-side encryption • Data at Rest • Server-Side Encryption • S3 encrypts the object before saving it on disks in its data centers and decrypt it when the objects are downloaded • Client-Side Encryption • data is encrypted at the client-side and uploaded to S3. • the encryption process, the encryption keys, and related tools are managed by the user.
- 3. S3 Server-Side Encryption • Server-side encryption is about data encryption at rest • Server-side encryption encrypts only the object data. • Any object metadata is not encrypted. • S3 handles the encryption (as it writes to disks) and decryption (when objects are accessed) of the data objects • There is no difference in the access mechanism for both encrypted or unencrypted objects and is handled transparently by S3
- 4. Server-Side Encryption with S3-Managed Keys – SSE-S3 • Each object is encrypted with a unique data key employing strong multi- factor encryption. • SSE-S3 encrypts the data key with a master key that is regularly rotated. • S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256), to encrypt the data. • Whether or not objects are encrypted with SSE-S3 can’t be enforced when they are uploaded using pre-signed URLs, because the only way server- side encryption can be specified is through the AWS Management Console or through an HTTP request header • Must set header x-amz-server-side-encryption to AES-256 • For enforcing server-side encryption for all of the objects that are stored in a bucket, use a bucket policy that denies permissions to upload an object unless the request includes x-amz-server-side-encryption header to request server-side encryption