‫So just a short lecture
‫on default encryption versus bucket policies.
‫So by default
‫now all buckets are having a default encryption of SSE-S3.
‫So it's applied automatically
‫to new objects toward the new buckets.
‫But you can change this
‫to be a different default encryption, for example, SSE-KMS.
‫Nonetheless, you can also force encryption
‫by using a bucket policy to refuse any API call
‫to put an S3 object without the correct encryption headers.
‫So for example, SSC-KMS or SSE-C.
‫So this is the kind of bucket policies
‫you could have in, for example,
‫this one is saying, hey, if you do a PUT object
‫but you don't have the encryption header that says AWS KMS,
‫then deny this request.
‫Or, hey, if you are uploading this
‫but there is no customer side algorithm, so no SSE-C,
‫then deny this object.
‫So this is just an example,
‫but at least you see that a bucket policy
‫can also force a way to have encryption in your buckets.
‫And by the way, bucket policies are always going
‫to be evaluated before your default encryption settings.
‫So that's it, just remember, default encryption
‫is on by default with SSC-S3 but you can change it
‫and you can apply a bucket policy preemptively
‫to force encryption to the one you want.
‫Alright, that's it.
‫I hope you liked it and I will see you in the next lecture.