The following diagram shows a graphical representation of how the encryption process works when using SSE-KMS in Amazon S3:
Let's go over the steps in the preceding diagram and see how encryption takes place:
- Firstly, the client identifies the object(s) that are to be uploaded to S3, indicating SSE-KMS as the encryption mechanism, selecting either an AWS-managed or customer-managed CMK.
- Amazon S3 will respond by initiating a request to generate DEKs from KMS to allow S3 to encrypt the data submitted by the client.
- Using the CMK selected during step 1, KMS will then generate two data keys, a plaintext data key, and an encrypted version of that same data key.
- KMS will send both of these data keys back to S3 to allow S3 to begin the encryption process using the plaintext data key.
- At this stage, S3 then encrypts the object data with the plaintext version of the data key and stores the resulting encrypted object alongside the encrypted version of the data key. The plaintext...
