docs.aws.amazon.com Open in urlscan Pro
143.204.98.96  Public Scan

Form analysis
0 forms found in the DOM

Text Content

SELECT YOUR COOKIE PREFERENCES

We use cookies and similar tools to enhance your experience, provide our
services, deliver relevant advertising, and make improvements. Approved third
parties also use these tools to help us deliver advertising and provide certain
site features.

CustomizeAccept all


CUSTOMIZE COOKIE PREFERENCES

We use cookies and similar tools (collectively, "cookies") for the following
purposes.


ESSENTIAL

Essential cookies are necessary to provide our site and services and cannot be
deactivated. They are usually set in response to your actions on the site, such
as setting your privacy preferences, signing in, or filling in forms.




PERFORMANCE

Performance cookies provide anonymous statistics about how customers navigate
our site so we can improve site experience and performance. Approved third
parties may perform analytics on our behalf, but they cannot use the data for
their own purposes.

Allow performance category
Allowed


FUNCTIONAL

Functional cookies help us provide useful site features, remember your
preferences, and display relevant content. Approved third parties may set these
cookies to provide certain site features. If you do not allow these cookies,
then some or all of these services may not function properly.

Allow functional category
Allowed


ADVERTISING

Advertising cookies may be set through our site by us or our advertising
partners and help us deliver relevant marketing content. If you do not allow
these cookies, you will experience less relevant advertising.

Allow advertising category
Allowed

Blocking some types of cookies may impact your experience of our sites. You may
review and change your choices at any time by clicking Cookie preferences in the
footer of this site. We and selected third-parties use cookies or similar
technologies as specified in the AWS Cookie Notice

.

CancelSave preferences


English

Sign In to the Console
 1. AWS
 2. ...
 3. Documentation
 4. Amazon Simple Storage Service (S3)
 5. User Guide


Feedback
Preferences
Amazon Simple Storage Service
User Guide
 * What is Amazon S3?
 * Getting started
    * Setting up
    * Step 1: Create a bucket
    * Step 2: Upload an object
    * Step 3: Download an object
    * Step 4: Copy an object
    * Step 5: Delete the objects and bucket
    * Next steps
    * Access control

 * Tutorials
    * Transforming data with S3 Object Lambda
    * Detecting and redacting PII data
    * Hosting video streaming
    * Batch-transcoding videos
    * Configuring a static website
    * Configuring a static website using a custom domain
       * Speeding up your website with Amazon CloudFront
       * Cleaning up example resources

 * Working with buckets
    * Buckets overview
    * Naming rules
    * Creating a bucket
    * Viewing bucket properties
    * Methods for accessing a bucket
    * Emptying a bucket
    * Deleting a bucket
    * Setting default bucket encryption
       * Enabling default encryption
       * Monitoring default encryption
   
    * Configuring Transfer Acceleration
       * Getting Started
       * Enabling Transfer Acceleration
       * Speed Comparison tool
   
    * Using Requester Pays
       * Configuring Requester Pays
       * Retrieving the requestPayment configuration
       * Downloading objects in Requester Pays buckets
   
    * Restrictions and limitations

 * Working with objects
    * Objects
    * Creating object keys
    * Working with metadata
       * Editing object metadata
   
    * Uploading objects
    * Using multipart upload
       * Configuring a lifecycle policy
       * Uploading an object using multipart upload
       * Uploading a directory
       * Listing multipart uploads
       * Tracking a multipart upload
       * Aborting a multipart upload
       * Copying an object
       * Multipart upload limits
   
    * Copying objects
    * Downloading an object
    * Checking object integrity
    * Deleting objects
       * Deleting a single object
       * Deleting multiple objects
   
    * Organizing and listing objects
       * Using prefixes
       * Listing objects
       * Using folders
       * Viewing an object overview
       * Viewing object properties
   
    * Using presigned URLs
       * Sharing objects
       * Uploading objects
       * Deleting an object
   
    * Transforming objects
       * Creating Object Lambda Access Points
       * Using Amazon S3 Object Lambda Access Points
       * Getting started with an AWS CloudFormation template
       * Configuring IAM policies
       * Writing Lambda functions
       * Using AWS built functions
       * Best practices and guidelines for S3 Object Lambda
       * Security considerations

 * Working with access points
    * Configuring IAM policies
    * Creating access points
       * Creating an access point
       * Creating access points restricted to a VPC
       * Managing public access
   
    * Using access points
       * Monitoring and logging
       * Managing access points
       * Using a bucket-style alias for your access point
       * Using access points
   
    * Restrictions and limitations

 * Working with Multi-Region Access Points
    * Creating Multi-Region Access Points
       * Configuring AWS PrivateLink
   
    * Using a Multi-Region Access Point
       * Multi-Region Access Point permissions
       * Request routing
       * Bucket replication
       * Supported operations
   
    * Managing Multi-Region Access Points
    * Monitoring and logging
       * Using CloudTrail
   
    * Restrictions and limitations

 * Security
    * Data protection
    * Data encryption
       * Server-side encryption
          * KMS keys Stored in AWS KMS
             * Specifying SSE-KMS
             * Using Amazon S3 Bucket Keys
                * Configuring an S3 Bucket Key for your bucket
                * Configuring an S3 Bucket Key for an object
                * Viewing settings for an S3 Bucket Key
         
          * Amazon S3-managed encryption keys
             * Specifying SSE-S3
         
          * Customer-provided encryption keys
      
       * Using client-side encryption
   
    * Internetwork privacy
    * AWS PrivateLink for Amazon S3
    * Identity and access management
       * Overview
       * Access policy guidelines
       * Request authorization
          * For a bucket operation
          * For an object operation
      
       * Bucket policies and user policies
          * Policies and Permissions
             * Resources
             * Principals
             * Actions
             * Conditions
                * Examples
            
             * Actions, resources, and conditions
         
          * Bucket policies
             * Adding a bucket policy
             * Controlling VPC access
             * Bucket policy examples
         
          * IAM user policies
             * Controlling bucket access
             * User policy examples
         
          * Example walkthroughs
             * Setting up tools
             * Granting permissions
             * Granting cross-account permissions
             * Granting object permissions
             * Granting cross-account object permissions
         
          * Using service-linked roles
      
       * AWS managed policies
       * Managing access with ACLs
          * ACL overview
          * Finding the canonical ID
          * Configuring ACLs
      
       * Using CORS
          * CORS configuration
          * Configuring CORS
          * Troubleshooting CORS
      
       * Blocking public access
          * Configuring account settings
          * Configuring bucket and access point settings
      
       * Reviewing bucket access
       * Verifying bucket ownership
   
    * Controlling object ownership
       * Prerequisites for disabling ACLs
       * Creating a bucket
       * Setting Object Ownership
       * Viewing Object Ownership settings
       * Disabling ACLs for all new buckets
       * Troubleshooting
   
    * Logging and monitoring
    * Compliance Validation
    * Resilience
    * Infrastructure security
    * Configuration and vulnerability analysis
    * Security Best Practices

 * Managing storage
    * Using S3 Versioning
       * S3 Versioning
       * Enabling versioning on buckets
       * Configuring MFA delete
       * Working with versioning-enabled objects
          * Adding objects
          * Listing objects
          * Retrieving object versions
             * Retrieving version metadata
             * Restoring previous versions
         
          * Deleting object versions
             * Working with delete markers
             * Managing delete markers
             * Deleting with MFA delete
         
          * Configuring permissions
      
       * Working with versioning-suspended objects
          * Adding objects
          * Retrieving objects
          * Deleting objects
   
    * Using AWS Backup for Amazon S3
    * Working with archived objects
       * Archive retrieval options
       * Restoring an archived object
       * Querying archived objects
   
    * Using Object Lock
       * S3 Object Lock
       * Configuring Object Lock on the console
       * Managing Object Lock
   
    * Managing storage classes
    * Amazon S3 Intelligent-Tiering
       * How S3 Intelligent-Tiering works
       * Using S3 Intelligent-Tiering
       * Managing S3 Intelligent-Tiering
   
    * Managing lifecycle
       * Transitioning objects
       * Expiring objects
       * Setting lifecycle configuration
       * Using other bucket configurations
       * Configuring Lifecycle event notifications
       * Lifecycle configuration elements
       * Examples of S3 Lifecycle configuration
   
    * Managing inventory
       * Configuring Amazon S3 Inventory
       * Setting up notifications for inventory completion
       * Locating your inventory
       * Querying inventory with Athena
       * Converting empty version ID strings to null strings
   
    * Replicating objects
       * What's replicated?
       * Setting up replication
          * Replication configuration
          * Setting up permissions
          * Replication examples
             * Configuring for buckets in the same account
             * Configuring for buckets in different accounts
             * Changing replica owner
             * Replicating encrypted objects
             * Using S3 Replication Time Control
             * Managing replication rules
      
       * Replicate existing objects
          * Configuring IAM policies
          * Batch Replication for a first replication rule or new destination
          * Batch Replication for existing replication rules
      
       * Additional configurations
          * Monitoring progress
             * Viewing replication metrics using the Amazon S3 console
         
          * Using S3 Replication Time Control
             * Best practices and guidelines for S3 RTC
         
          * Replicating delete markers
          * Replicating metadata changes
          * Changing the replica owner
          * Replicating encrypted objects
      
       * Getting replication status
       * Troubleshooting
       * Additional considerations
   
    * Using object tags
       * Access control
       * Managing object tags
   
    * Using cost allocation tags
       * Billing and usage reporting
          * Billing reports
          * Usage report
          * Understanding billing and usage reports
   
    * Using Amazon S3 Select
       * S3 Select examples
       * SQL Reference
          * SELECT Command
          * Data Types
          * Operators
          * Reserved Keywords
          * SQL Functions
             * Aggregate Functions (Amazon S3 Select only)
             * Conditional Functions
             * Conversion Functions
             * Date Functions
             * String Functions
   
    * Using Batch Operations
       * Granting permissions
       * Creating a job
       * Supported operations
          * Copy objects
             * Examples that use Batch Operations to copy objects
                * Using an inventory report to copy objects across AWS accounts
                * Using a CSV manifest to copy objects across AWS accounts
                * Using Batch Operations to encrypt objects with Bucket Keys
         
          * Invoke AWS Lambda function
          * Replace all object tags
          * Delete all object tags
          * Replace access control list
          * Restore objects
          * Object Lock retention
          * Object Lock legal hold
      
       * Managing jobs
          * Listing jobs
          * Viewing job details
          * Assigning job priority
      
       * Tracking job status and completion reports
          * Examples of tracking using Amazon EventBridge
          * Examples of completion reports
      
       * Using tags
          * Creating a job
          * Deleting tags
          * Putting job tags
          * Getting job tags
          * Controlling permissions
      
       * Managing S3 Object Lock
          * Enabling Object Lock
          * Setting retention
          * Setting retention compliance
          * Setting retention governance
          * Turning off legal hold

 * Monitoring Amazon S3
    * Monitoring tools
    * Logging options
    * Logging with CloudTrail
       * CloudTrail events
       * Example log files
       * Enabling CloudTrail
       * Identifying S3 requests
   
    * Logging server access
       * Enabling server access logging
       * Log format
       * Deleting log files
       * Identifying S3 requests
   
    * Monitoring metrics with CloudWatch
       * Metrics and dimensions
       * Accessing CloudWatch metrics
       * CloudWatch metrics configurations
          * Creating a metrics configuration for all objects
          * Filtering by prefix, object tag, or access point
          * Deleting a metrics filter
   
    * Amazon S3 Event Notifications
       * Notification types and destinations
       * Using SQS, SNS, and Lambda
          * Granting permissions
          * Enabling notifications in the S3 console
          * Walkthrough: Configuring SNS or SQS
          * Configuring notifications using object key name filtering
          * Event message structure
      
       * Using EventBridge
          * EventBridge permissions
          * Enabling EventBridge
          * EventBridge event message structure
          * Amazon EventBridge mapping and troubleshooting

 * Using analytics and insights
    * Storage Class Analysis
       * Configuring storage class analysis
   
    * S3 Storage Lens
       * Understanding S3 Storage Lens
       * Working with Organizations
       * S3 Storage Lens permissions
       * Viewing storage metrics
          * Viewing metrics on the dashboards
          * Viewing metrics in a data export
             * Encrypting metrics exports
             * What is an export manifest?
             * S3 Storage Lens export schema
         
          * Monitor S3 Storage Lens metrics in CloudWatch
             * S3 Storage Lens metrics and dimensions
             * Enabling CloudWatch publishing
             * Using CloudWatch
      
       * Using Amazon S3 Storage Lens to optimize your storage costs
       * Metrics glossary
       * Working with S3 Storage Lens
          * Using the S3 console
             * Viewing a dashboard
             * Creating and updating dashboards
                * Creating a dashboard
                * Updating a dashboard
            
             * Disabling or deleting a dashboard
                * Disabling a dashboard
                * Deleting a dashboard
            
             * Working with AWS Organizations
                * Enabling trusted access in your organization
                * Disabling trusted access in your organization
                * Registering delegated admins
                * Deregistering delegated admins
         
          * Using the AWS CLI
          * Using the SDK for Java
   
    * Tracing requests using X-Ray

 * Hosting a static website
    * Website endpoints
    * Enabling website hosting
    * Configuring an index document
    * Configuring a custom error document
    * Setting permissions for website access
    * Logging web traffic
    * Configuring a redirect

 * Developing with Amazon S3
    * Making requests
       * Making requests over IPv6
          * Using dual-stack endpoints
      
       * Making requests using the AWS SDKs
          * Using AWS account or IAM user credentials
          * Using IAM user temporary credentials
          * Using federated user temporary credentials
      
       * Making requests using the REST API
          * Virtual hosting of buckets
          * Request redirection and the REST API
   
    * Using the AWS CLI
    * Using the AWS SDKs
       * Using the AWS SDK for Java
       * Using the AWS SDK for .NET
       * Using the AWS SDK for PHP and Running PHP Examples
       * Using the AWS SDK for Ruby - Version 3
       * Using the AWS SDK for Python (Boto)
       * Using the AWS Mobile SDKs for iOS and Android
       * Using the AWS Amplify JavaScript Library
       * Using the AWS SDK for JavaScript
   
    * Using the REST API
       * Request routing
   
    * Error handling
       * The REST error response
       * The SOAP error response
       * Amazon S3 error best practices
   
    * Reference
       * Appendix a: Using the SOAP API
          * Common SOAP API elements
          * Authenticating SOAP requests
          * Setting access policy with SOAP
      
       * Appendix b: Authenticating requests (AWS signature version 2)
          * Authenticating requests using the REST API
          * Signing and authenticating REST requests
          * Browser-based uploads using POST
             * HTML forms
             * Upload examples
             * POST with adobe flash

 * Optimizing Amazon S3 performance
    * Performance Guidelines
    * Performance Design Patterns

 * What is S3 on Outposts?
    * Setting up your Outpost
    * How S3 on Outposts is different
    * Getting started with S3 on Outposts
       * Setting up IAM
       * Using the S3 console
       * Using the AWS CLI and SDK for Java
   
    * Networking for S3 on Outposts
    * Working with S3 on Outposts buckets
       * Creating a bucket
       * Adding tags
       * Creating and managing a lifecycle configuration
          * Using the console
          * Using the AWS CLI and SDK for Java
      
       * Using bucket policies
          * Adding a bucket policy
          * Viewing a bucket policy
          * Deleting a bucket policy
      
       * Listing buckets
       * Getting a bucket
       * Deleting your bucket
       * Working with access points
          * Creating an access point
          * Viewing access point configuration
          * Listing access points
          * Deleting an access point
          * Adding an access point policy
          * Viewing an access point policy
      
       * Working with endpoints
          * Creating an endpoint
          * Listing endpoints
          * Deleting an endpoint
   
    * Working with S3 on Outposts objects
       * Getting an object
       * Listing objects
       * Deleting objects
       * Using HeadBucket
       * Performing a multipart upload
   
    * Security
    * Managing S3 on Outposts storage
       * CloudWatch metrics
       * Amazon CloudWatch Events
       * CloudTrail logs
       * Sharing S3 on Outposts
       * Other services
   
    * Developing with S3 on Outposts
       * S3 on Outposts APIs
       * Configuring S3 control client

 * Code examples
    * Actions
       * Add CORS rules to a bucket
       * Add a lifecycle configuration to a bucket
       * Add a policy to a bucket
       * Copy an object from one bucket to another
       * Create a bucket
       * Delete CORS rules from a bucket
       * Delete a policy from a bucket
       * Delete an empty bucket
       * Delete an object
       * Delete multiple objects
       * Delete the lifecycle configuration of a bucket
       * Delete the website configuration from a bucket
       * Determine the existence and content type of an object
       * Determine the existence of a bucket
       * Get CORS rules for a bucket
       * Get an object from a bucket
       * Get the ACL of a bucket
       * Get the ACL of an object
       * Get the Region location for a bucket
       * Get the lifecycle configuration of a bucket
       * Get the policy for a bucket
       * Get the website configuration for a bucket
       * List buckets
       * List in-progress multipart uploads
       * List object versions in a bucket
       * List objects in a bucket
       * Restore an archived copy of an object
       * Set a new ACL for a bucket
       * Set the ACL of an object
       * Set the website configuration for a bucket
       * Upload an object to a bucket
   
    * Scenarios
       * Create a presigned URL
       * Getting started with buckets and objects
       * Manage versioned objects in batches with a Lambda function
       * Remove delete markers from versioned objects
       * Use a transfer manager to upload and download files
       * Work with versioned objects
   
    * Cross-service examples
       * Build an Amazon Transcribe app
       * Convert text to speech and back to text
       * Create an Amazon Textract explorer application
       * Detect PPE in images
       * Detect entities in text extracted from an image
       * Detect faces in an image
       * Detect objects in images
       * Detect people and objects in a video
       * Save EXIF and other image information

 * Troubleshooting
    * Troubleshooting Amazon S3 by Symptom
    * Getting Amazon S3 Request IDs for AWS Support

 * Document history
 * AWS glossary


Protecting data using server-side encryption - Amazon Simple Storage Service
AWSDocumentationAmazon Simple Storage Service (S3)User Guide


PROTECTING DATA USING SERVER-SIDE ENCRYPTION

PDF
RSS

Server-side encryption is the encryption of data at its destination by the
application or service that receives it. Amazon S3 encrypts your data at the
object level as it writes it to disks in its data centers and decrypts it for
you when you access it. As long as you authenticate your request and you have
access permissions, there is no difference in the way you access encrypted or
unencrypted objects. For example, if you share your objects using a presigned
URL, that URL works the same way for both encrypted and unencrypted objects.
Additionally, when you list objects in your bucket, the list API returns a list
of all objects, regardless of whether they are encrypted.

Note

You can't apply different types of server-side encryption to the same object
simultaneously.

You have three mutually exclusive options, depending on how you choose to manage
the encryption keys.

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)

When you use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), each
object is encrypted with a unique key. As an additional safeguard, it encrypts
the key itself with a root key that it regularly rotates. Amazon S3 server-side
encryption uses one of the strongest block ciphers available, 256-bit Advanced
Encryption Standard (AES-256), to encrypt your data. For more information, see
Protecting data using server-side encryption with Amazon S3-managed encryption
keys (SSE-S3).

Server-Side Encryption with KMS keys Stored in AWS Key Management Service
(SSE-KMS)

Server-Side Encryption with AWS KMS keys (SSE-KMS) is similar to SSE-S3, but
with some additional benefits and charges for using this service. There are
separate permissions for the use of a KMS key that provides added protection
against unauthorized access of your objects in Amazon S3. SSE-KMS also provides
you with an audit trail that shows when your KMS key was used and by whom.
Additionally, you can create and manage customer managed keys or use AWS managed
keys that are unique to you, your service, and your Region. For more
information, see Protecting data using server-side encryption with AWS Key
Management Service (SSE-KMS).

Server-Side Encryption with Customer-Provided Keys (SSE-C)

With Server-Side Encryption with Customer-Provided Keys (SSE-C), you manage the
encryption keys and Amazon S3 manages the encryption, as it writes to disks, and
decryption, when you access your objects. For more information, see Protecting
data using server-side encryption with customer-provided encryption keys
(SSE-C).

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thanks for your vote. To provide details, send feedback.

This page is helpful.

Thanks for your vote. To provide details, send feedback.

This page is not helpful.


Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please
refer to your browser's Help pages for instructions.

Document Conventions
Data encryption
KMS keys Stored in AWS KMS
Did this page help you?
Yes No

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of
it.

Feedback




Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.

Feedback




Provide feedback

Edit this page on GitHub
Previous topic: Data encryption

Next topic: KMS keys Stored in AWS KMS
Need help?
   
 * Try AWS re:Post
   
   
 * Connect with an AWS IQ expert
   

Privacy
Site terms
Cookie preferences
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of
it.

Feedback

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.

Feedback


On this page