S3 Data Protection and Encryption Options
S3 provides the capability to encrypt objects at rest, with the default option being storing objects unencrypted. However, if your environment requires compliance, it is highly likely that encrypting stored objects will be necessary.
When you determine that encryption is necessary for your S3-stored objects, you can consider server-side and client-side encryption. Before deciding, it’s essential to ask yourself some key questions, as follows:
- Do you need to manage the encryption key?
- Is there a compliance policy you must follow with strict rotation guidelines?
- Where will the encryption key be stored?
- Will you be using AWS KMS to store the key or do you have something else in mind that your organization uses (such as CloudHSM or a third-party solution)?
- Who will be responsible for the encryption and decryption of the data?
- Will it be a service-based role performed by an application or end user?
After you have thought...
