‫Hi, and welcome to this lecture.
‫We're going to have a look at encryption options
‫for our S3 buckets.
‫So I'll call this one demo-stephane-bucket-encryption.
‫And then I will scroll down
‫and I will make sure to enable versioning,
‫just to show you what it means
‫with versioning and encryption.
‫And now we scroll down
‫and we look at the default encryption options.
‫So as we can see, we have,
‫we must specify a default encryption for our buckets.
‫So it's either SSE-S3 or SSE-KMS,
‫so that means that any object uploaded into my S3 bucket
‫is going to be encrypted.
‫There is no way around it.
‫Now we're going to choose SSE-S3,
‫and we'll have a look at the SSE-KMS type of encryption
‫later on in this lecture.
‫So let's go ahead and create this bucket.
‫And because I have specified a default encryption mechanism
‫we should, when we upload an object,
‫figure out that yes indeed it's been uploaded
‫with the right encryption mechanism.
‫So let's take a coffee.jpg file, we're going to upload it.
‫Close this.
‫And if I go into my coffee.jpg,
‫scroll down under server-side encryption settings,
‫I can see that it is encrypted
‫with Amazon S3-manage-keys SSE-S3.
‫So that makes sense, right?
‫And I can go ahead and edit this.
‫And actually when you edit the encryption of an object,
‫as you can see this will create a new version of the object.
‫This is why I enabled the versioning of the bucket,
‫so you can see,
‫and you'll have an updated settings.
‫So let's have a look.
‫So we're going to have server-side encryption
‫And do we want to use the bucket settings for default?
‫No, because we want to do something else.
‫So we want to override the bucket settings
‫for default encryption, and I will choose SSE-KMS.
‫So now when we have SSE-KMS, we need to enter a KMS key.
‫So either we go with the ARN, the Amazon resource name,
‫or we choose it from an available key.
‫So here I have two keys,
‫one I created before, but you don't have it right now.
‫You should have only the aws/s3.
‫So I want to show you,
‫because this creating your own key is a paid feature,
‫so using the one from AWS is not paid.
‫So this key, the aws/s3 key,
‫is the default KMS key for your S3 bucket
‫and you can use it without any cost.
‫But if you wanted to create your own KMS key,
‫you can create it and also assign it
‫as the KMS key to encrypt your object with.
‫But let's go ahead and use the aws/s3 key together,
‫and then click on save changes.
‫Close this, and now if I go into versions,
‫I can see I have two versions of my objects.
‫And if we look at this current version right here
‫that I just created, scroll down,
‫we can see indeed that this is encrypted with SSE-KMS,
‫and we have the encryption key ARN right here.
‫Okay, this is exactly the same process
‫as uploading an object.
‫So you add a file, and again beach.jpg for example,
‫and under properties, you scroll down,
‫and you can actually specify an encryption key.
‫So you can override what the default is for your bucket.
‫And so again, we can use the default encryption
‫or we can override it with choosing SSE-KMS.
‫So we've seen this.
‫Now what about the default encryption mechanism?
‫So where is it handled?
‫Well, if you go under properties
‫and you go for default encryption,
‫you have here the option to choose SSE-S3 or SSE-KMS.
‫And regarding this bucket key option,
‫is just to lower the SSE-KMS key costs if you want to,
‫if you have a high usage of your bucket.
‫Now there are two things we don't see in here.
‫The first one is around SSE-C.
‫So SSE-C is when you provide your own key outside of AWS,
‫and this option is not supported by the console,
‫as you can see.
‫It is only supported if you use the CLI or the SDK of AWS.
‫Now the last option of encryption I've shown you
‫is around client-side encryption,
‫and client-side encryption is not a server-side encryption
‫so there's no option in the console to do it.
‫What you have to do
‫is to encrypt the object while client side,
‫and then you will yourself
‫upload the encrypted object in AWS
‫and decrypt it again client-side,
‫so you don't need to indicate to AWS
‫that you have encrypted your object on your own.
‫And that's it, we've seen all the options
‫for encryption in AWS.
‫I hope you liked it and I will see you in the next lecture.