# 3.8 S3 Security and Encryption

## Security

By default, all newly created buckets are **private**.

You can setup access control to your buckets using:

* Bucket policies - bucket level
* Access control lists - object level

S3 buckets can be configured to create access logs which log all requests made to the S3 bucket. This can be done to another bucket or another AWS account (cross-account accessing).

## Encryption

Encryption is on object level. By default, S3 objects are **not** encrypted. You need to enable SSE. There are two kinds of encryption can be used in the communication between client and S3 server.

\#1. In Transit:

Using HTTPS, which will use SSL/TLS.

\#2. At Rest:

For **server-side** encryption, there are three kinds of encryption:

* Server-Side Encryption with S3 Managed Keys - **SSE-S3 (AES-256)**: each object will be encrypted by a unique key employing strong multi-factor encryption.&#x20;
* Server-Side Encryption with AWS Key Management Service, Managed Keys - **SSE-KMS**: in addition to the secure services of SSE-S3, SSE-KMS also provide separate permissions for the use of an envelope Key. Envelope key is a key that protect your data encryption key. SSE-KMS also provides you with an audit trail of when your keys were used and who was actually using the keys, which give you a transparency of who is decrypting what and when. You also have the option to create and manage encryption keys yourself or you can use default keys that's unique to you the service that you are using as well as the region that you are working in.&#x20;
* Server-Side Encryption with Customer Provided keys - **SSE-C**: this where you managed the encryption keys and Amazon manages the encryption as it writes to disk, and the encryption as to when you access your objects. But you actual management of the key is done by yourself.&#x20;

For the **client-side** encryption: You encrypt your objects and upload it to S3. There are also two kinds of encryptions:

* Client-Side Encryption with AWS KMS-Managed Customer Master Key - **CMK**
* Client-Side Encryption with a Client-Side Master Key
