pythonamazon-web-servicesamazon-s3boto3amazon-kms

Difference between KMS encryption and S3 SSE


Is there any difference if I KMS encrypt a file and push that file to S3 bucket vs put the file to S3 bucket using SSE KMS encryption?


Solution

  • First: the KMS Encrypt operation will only accept 4K of data, so it isn't a general solution.

    With S3 server-side encryption, the S3 back-end will generate a key, use that key to encrypt the data, use KMS to encrypt the key, then store the encrypted data and the encrypted key. When you read the data it does the reverse: use KMS to decrypt the key, then use the decrypted key to decrypt the data.

    You could implement the same thing yourself, storing the encrypted key in the S3 object's metadata. However, this means writing code to do the object encryption yourself, and unless you are familiar with encryption it's possible that you could make a mistake.

    There are some limited use-cases for client-side encryption, but in those cases you'd be using an encryption key that's not provided by KMS.