Amazon’s cloud storage Simple Storage Service (S3) now encrypts all new objects added on buckets server-side at no extra cost.
In an announcement (opens in new tab) on the Amazon Web Services (AWS) blog, the company claimed that while encryption had always been easy to enable, administrators always had to be mindful of the feature, whereas now the encryption process is “zero click”, with no impact on performance.
Existing Amazon S3 customers can verify that their objects are encrypted in the S3 section of the AWS management console, and confirm the change by configuring AWS CloudTrail to log data events (opens in new tab), albeit at an additional cost.
AWS Encryption
Amazon S3’s default encryption method, SSE-S3, uses the AES-256 standard, which has been an optional feature of Amazon S3 since 2011, as a default. Here, Amazon generates and manages the keys, with no action required from an end user.
In the announcement, Sébastien Stormacq, a Senior Developer Advocate at AWS, wrote that “the opt-in nature of SSE-S3 meant that you had to be certain that it was always configured on new buckets and verify that it remained configured properly over time.”
“For organizations that require all their objects to remain encrypted at rest with SSE-S3, this update helps meet their encryption compliance requirements without any additional tools or client configuration changes.”
For advanced users looking for more control over the encryption process, the service also offers customer-provided encryption keys (SSE-C) (opens in new tab), AWS Key Management Service keys (SSE-KMS) (opens in new tab), as well as client-side encryption, via a library such as the Amazon S3 encryption client, as means to protect data.
Many IT admins will appreciate the variety of ways to keep data secure, the straightforward nature of SSE-S3, requiring no additional knowledge (and now input) on their part may appeal to smaller businesses looking to keep data safe.
According to Amazon, the change has been rolled out across all regions where AWS is available. Existing customers can also retroactively encrypt data by following instructions in a separate AWS blog post (opens in new tab).
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba