SAABlog
KOEN
SecurityIntermediate

S3 Encryption Options: SSE-S3 vs SSE-KMS vs SSE-C - When to Use What?

Compare AWS S3 server-side encryption options (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C) and client-side encryption. Learn selection criteria for different scenarios.

PHILOLAMB••-•Updated: January 31, 2026
S3 EncryptionSSE-S3SSE-KMSSSE-CKMS

Related Exam Domains

  • Domain 1: Design Secure Architectures

Key Takeaway: S3 Encryption Option Selection

Bottom line: SSE-S3 (default) is sufficient for most cases. Use SSE-KMS when you need detailed key control or auditing, and client-side encryption when even AWS shouldn't access the data.

Quick Comparison

Encryption TypeKey ManagerAdditional CostCloudTrail AuditBest For
SSE-S3AWS S3NoneLimitedDefault encryption, minimal overhead
SSE-KMSAWS KMSYesFull supportCompliance, key control needed
DSSE-KMSAWS KMSYesFull supportDual-layer encryption regulations
SSE-CCustomerNoneLimitedOwn key management system
Client-sideCustomerNoneN/AAWS cannot access data

Exam Tip

Exam Essential: "Minimal operational overhead" → SSE-S3, "Key usage auditing" → SSE-KMS, "AWS cannot access data" → Client-side encryption

When is S3 Encryption Needed?

Since January 5, 2023, all S3 objects are automatically encrypted with SSE-S3. Default encryption is applied without any configuration.

However, you need to change encryption type in these situations:

When to Change to SSE-KMS

  • When you need to audit who used keys and when
  • When you need detailed access control over keys
  • When you have compliance requirements (HIPAA, PCI-DSS, etc.)
  • When you need automatic key rotation policies

When Client-Side Encryption is Needed

  • When no third party including AWS should see the data
  • When encryption must be maintained during transit
  • When using your own key management system (HSM, etc.)

Server-Side Encryption

Server-side encryption encrypts data when S3 stores it to disk and automatically decrypts on download.

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│   Client    │────▶│   Amazon    │────▶│    Disk     │
│ (plaintext) │     │     S3      │     │ (encrypted) │
└─────────────┘     │  (encrypts) │     └─────────────┘
                    └─────────────┘

SSE-S3: Amazon S3 Managed Keys

The simplest encryption option where AWS fully manages the keys.

Object Upload
    │
    ▼
┌─────────────────────────────────────────┐
│           Amazon S3                      │
│  ┌───────────┐      ┌───────────┐       │
│  │   Data    │─────▶│  AES-256  │       │
│  │(plaintext)│      │ Encryption│       │
│  └───────────┘      └─────┬─────┘       │
│                           │              │
│  ┌───────────┐      ┌─────▼─────┐       │
│  │  S3 Root  │─────▶│Object Key │       │
│  │   Key     │Encrypt│ (unique) │       │
│  └───────────┘      └───────────┘       │
└─────────────────────────────────────────┘
FeatureDescription
AlgorithmAES-256 (AES-GCM)
Key ManagementFully managed by S3, auto-rotated
CostNo additional cost
DefaultDefault for all buckets since January 2023

Best For:

  • Only basic at-rest encryption needed
  • No additional key management requirements
  • Wanting minimal operational overhead

SSE-KMS: AWS KMS Managed Keys

Use when you need stronger control and auditing.

Object Upload
    │
    ▼
┌─────────────────────────────────────────┐
│           Amazon S3                      │
│                                          │
│  ┌───────────────────────────────────┐  │
│  │         AWS KMS                    │  │
│  │  ┌─────────────┐  ┌─────────────┐ │  │
│  │  │ CMK (Customer│  │  Data Key  │ │  │
│  │  │ Managed Key)│──▶│ Generation │ │  │
│  │  └─────────────┘  └──────┬──────┘ │  │
│  │        │                 │        │  │
│  │  CloudTrail              │        │  │
│  │   Logging                │        │  │
│  └──────────────────────────┼────────┘  │
│                             │            │
│  ┌───────────┐        ┌─────▼─────┐     │
│  │   Data    │───────▶│  AES-256  │     │
│  │(plaintext)│        │ Encryption│     │
│  └───────────┘        └───────────┘     │
└─────────────────────────────────────────┘
FeatureDescription
Key TypesAWS managed key or Customer Managed Key (CMK)
AuditingAll key usage logged in CloudTrail
Access ControlDetailed permissions via key policies
Key RotationAuto-rotation configurable (1-year cycle)
CostKMS API call charges apply

Best For:

  • Need audit logs for key usage
  • Compliance requirements (HIPAA, PCI-DSS)
  • Need detailed access control over keys
  • Key sharing across AWS services

Exam Tip

SSE-KMS Note: KMS has request quotas per second. For high-volume object processing, enable S3 bucket keys to reduce KMS calls.

DSSE-KMS: Dual-Layer Encryption

Applies two independent encryption layers.

┌─────────────────────────────────────────┐
│      Dual-Layer Encryption (DSSE-KMS)    │
│                                          │
│  ┌───────────────────────────────────┐  │
│  │  Layer 1: AWS KMS Data Key        │  │
│  │    ┌─────────────────────────┐    │  │
│  │    │ Layer 2: S3 Managed Key │    │  │
│  │    │   ┌─────────────────┐   │    │  │
│  │    │   │  Original Data  │   │    │  │
│  │    │   └─────────────────┘   │    │  │
│  │    └─────────────────────────┘    │  │
│  └───────────────────────────────────┘  │
└─────────────────────────────────────────┘
FeatureDescription
Encryption Layers2 (KMS + S3 managed)
ComplianceNSA CNSSP 15, FIPS compliant
CostHigher than SSE-KMS

Best For:

  • Strictly regulated industries (finance, government, defense)
  • Multi-layer encryption mandatory requirements
  • DAR CP (Data-at-Rest Capability Package) 5.0 compliance

SSE-C: Customer Provided Keys

Customer manages keys and S3 only performs encryption/decryption.

┌─────────────┐                    ┌─────────────┐
│   Client    │                    │  Amazon S3  │
│             │                    │             │
│  ┌───────┐  │   HTTPS + Key      │  ┌───────┐  │
│  │Encrypt│──┼───────────────────▶│  │Encrypt│  │
│  │  Key  │  │                    │  │ Action│  │
│  └───────┘  │                    │  └───────┘  │
│             │                    │             │
│  Note: Key  │                    │  Key not   │
│  loss means │                    │  stored    │
│  data lost  │                    │             │
└─────────────┘                    └─────────────┘
FeatureDescription
Key StorageAWS does not store keys
Request MethodKey must be sent with every request
ProtocolHTTPS required (key transmission security)
CostNo additional cost

Best For:

  • Have your own key management system
  • Need complete key ownership
  • Don't want to entrust keys to AWS

Exam Tip

April 2026 Change: SSE-C will be disabled by default for new buckets. If SSE-C is needed, explicitly enable with PutBucketEncryption API.

Client-Side Encryption

Encryption happens on the client before sending to S3.

┌─────────────────┐     ┌─────────────┐     ┌─────────────┐
│     Client      │     │   Amazon    │     │    Disk     │
│  ┌───────────┐  │     │     S3      │     │             │
│  │ Encryption│  │────▶│ (receives   │────▶│ (ciphertext │
│  │  (local)  │  │     │  ciphertext)│     │  as-is)     │
│  └───────────┘  │     │             │     │             │
└─────────────────┘     └─────────────┘     └─────────────┘

Server-Side vs Client-Side Encryption

AspectServer-SideClient-Side
Encryption LocationAWS S3Client (local)
Key ManagementAWS or CustomerCustomer
State During TransitPlaintext (TLS protected)Ciphertext
AWS Data AccessPossibleImpossible
Implementation ComplexityLowHigh
Performance ImpactNoneClient CPU usage

Client-Side Encryption Use Cases

✅ Block data access from third parties including AWS
✅ Maintain encryption during transit (additional protection beyond TLS)
✅ Use own HSM (Hardware Security Module)
✅ Special encryption algorithm requirements

Encryption Type Selection Guide

Selection by Scenario

ScenarioRecommendedReason
Minimal operational overheadSSE-S3Default, no additional setup
Key usage auditing neededSSE-KMSCloudTrail integration
Compliance (general)SSE-KMSKey policies, audit logs
Dual encryption regulationDSSE-KMS2-layer encryption
Own key management systemSSE-CCustomer keys
AWS access blockedClient-sideLocal encryption

Decision Flowchart

Need key usage auditing?
    │
    ├── Yes ──▶ Dual encryption regulation?
    │              │
    │              ├── Yes ──▶ DSSE-KMS
    │              │
    │              └── No ──▶ SSE-KMS
    │
    └── No ──▶ AWS should not access data?
                      │
                      ├── Yes ──▶ Client-side encryption
                      │
                      └── No ──▶ SSE-S3 (default)

How to Reduce Costs?

SSE-KMS Cost Optimization

SSE-KMS charges for each KMS API call. Reduce costs with these methods:

  1. Enable S3 Bucket Keys

    • Reduce KMS calls by up to 99%
    • Data key caching at bucket level

  2. Optimize Bulk Operations

    • Use S3 Batch Operations
    • Process many objects in single request

  3. Choose Appropriate Encryption Type

    • Use SSE-S3 if auditing not needed
    • SSE-S3 has no additional cost

Cost Comparison

Encryption TypeStorage CostAdditional Cost
SSE-S3Standard S3 rateNone
SSE-KMSStandard S3 rateKMS API call charges
DSSE-KMSStandard S3 rateKMS API call charges (more)
SSE-CStandard S3 rateNone

SAA-C03 Exam Focus Points

Common Question Types

  1. Minimal operational overhead encryption

    • Answer: SSE-S3
    • Hints: "No additional setup," "no extra cost"

  2. Key usage auditing and monitoring

    • Answer: SSE-KMS
    • Hints: "CloudTrail," "audit," "who accessed when"

  3. AWS cannot access data

    • Answer: Client-side encryption
    • Hints: "Block third-party access including AWS"

  4. Compliance requirements

    • Answer: SSE-KMS or DSSE-KMS
    • Hints: "HIPAA," "PCI-DSS," "dual encryption"

Exam Tip

Sample Exam Question: "A company needs to audit key usage and requires detailed access control over keys for sensitive data stored in S3. What is the most appropriate encryption method?"

→ Answer: SSE-KMS (CloudTrail auditing + key policy access control)

Key Memorization Points

KeywordAssociation
Minimal overheadSSE-S3
Audit, CloudTrailSSE-KMS
Key policy, access controlSSE-KMS
Dual encryption, FIPSDSSE-KMS
Own key managementSSE-C
AWS access blockedClient-side
HTTPS requiredSSE-C

FAQ

Q1: When should I choose between SSE-S3 and SSE-KMS?

A: SSE-S3 is sufficient for most cases. Only choose SSE-KMS when you need:

  • Key usage auditing (CloudTrail logging)
  • Detailed access control (key policies)
  • Compliance requirements (HIPAA, PCI-DSS, etc.)

Q2: How do I handle SSE-KMS request limits?

A: Enable S3 bucket keys. Caching data keys at bucket level can reduce KMS API calls by up to 99%.

Q3: Can I change encryption type for existing objects?

A: Yes, use S3 Batch Operations to copy existing objects while applying new encryption type. Combined with S3 Inventory, you can process billions of objects.

Q4: What happens if I lose the SSE-C key?

A: Data cannot be recovered. AWS doesn't store SSE-C keys, so key loss means permanent data inaccessibility.

Q5: Can I use server-side and client-side encryption together?

A: Yes, it's possible. After client-side encryption, uploading to S3 adds server-side encryption. Useful when double protection is needed.

Summary

The key to S3 encryption option selection is choosing the appropriate level for your requirements:

  1. Default encryption: SSE-S3 (no extra cost, minimal operational overhead)
  2. Audit/Compliance: SSE-KMS (CloudTrail, key policies)
  3. Highest security: Client-side encryption (AWS cannot access)

SAA-C03 frequently tests choosing the right encryption type for the situation. Clearly understand each option's characteristics and use cases.