security - How to use SSE-S3 on Amazon S3? -

i want enable sse-s3 on amazon s3. click properties , check encryption box aes-256. says encrypting, done. can still read files without providing key, , when check properties again, shows radio buttons unchecked. did correctly? encrypted? confusing.

you're looking @ view of bucket in s3 console shows more 1 file, or shows 1 file file isn't selected. radio buttons allow set items select values select in radio buttons, radio buttons remain blank whenever multiple files shown, because they're there let make change -- not show values of existing object.

click on individual file , view properties , you'll see file stored server-side-encryption = aes256.

yes, can download file without needing decrypt it, because feature server-side encryption of data @ rest -- files encrypted s3 prior storage on physical media s3 runs on. done compliance purposes, regulatory restrictions or other contractual obligations require data encrypted at rest.

the encryption keys stored, separately object s3, , managed s3. in fact, encryption keys stored, encrypted, s3. (they generate key each object, , store key in encrypted form, using master key).

decryption of encrypted data requires no effort on part. when get encrypted object, fetch , decrypt key, , use decrypt data.

https://aws.amazon.com/blogs/aws/new-amazon-s3-server-side-encryption/

for data in transit, s3 encrypts whenever use https.

different feature that's available in console, s3 also supports server-side aes-256 encryption keys you manage. in scenario, called sse-c, still aren't responsible actual encryption/decryption, because s3 still you. difference s3 doesn't store key, , have present key s3 get request in order s3 fetch object, decrypt it, , return you. if don't provide correct key, s3 won't bother return object -- not in encrypted form. s3 knows whether you've sent right key get request, because s3 stores salted hmac of key along object, validation of key send when try fetch object, later.

this capability -- manage own keys -- requires https (otherwise you'd sending encryption key accross internet unencrypted) , accessible through api, not console.

you cannot use amazon s3 console upload object , request sse-c. cannot use console update (for example, change storage class or add metadata) existing object stored using sse-c.

http://docs.aws.amazon.com/amazons3/latest/dev/serversideencryptioncustomerkeys.html

and, of course, method -- customer-managed keys -- particularly dangerous if don't have solid key-management infrastructure, because if lose key used upload file, file is, practical purposes, lost.