Okay, so now let's have a look
at S3 Default Encryption.
So if you want it to push an object an S3 buckets
and wanted to make sure that that object was encrypted,
then you could force encryption using a Bucket Policy.
And the bucket policy sees that if the encryption headers
are not specified in the API call,
made it to Amazon S3,
then you deny the request.
And therefore, the effect of that is that every object
that is put it into your S3 buckets has to be encrypted.
Now that's one way of doing it, but there's another way.
And it is to use the default encryption option
in Amazon S3.
So the idea is that if you upload an un-encrypted object
into Amazon S3,
it will be encrypted using the default encryption options.
But if you already uploaded encrypted,
then it will not be re encrypted.
Now something should note is that bucket policies
will be evaluated before default encryption.
So for example, if you want to force an encryption mechanism
of SSE S3, for example,
you would need to use a bucket policy.
But if you requirement's is just to make sure
that every single object in your bucket
is encrypted for this, you could use default encryption.
So let's create a buckets named
s3-default-encryption-stephane-demo
and then we're going to create these buckets.
So under the bucket itself, as you can see for properties,
you have a look at default encryption
and here we can automatically encrypt
a new objects store in this buckets.
So we'll enable it
and we've selected the type of encryption scheme.
Do you want Amazon SSE S3
or do you want SSE KMS?
And then you specify your key.
So we'll use SSE S3 for this example,
and it will save my changes.
And now, as you can expect, if I add a file and this file,
for example, is coffee.jpg.
And then as you can see,
I do not specify any encryption mechanism
and click on close.
Now, if I go back to my objects
and have a look at the encryption field.
In here, then we can see that yes,
servers-side-encryption setting is enabled for this object.
And it was using the server-side encryption,
Amazon SSE S3, okay.
If we try to upload another object now,
so let's upload a beach.jpg
but this time in terms of properties,
I'm going to specify a encryption key.
And here we can use either the default
encryption buckets settings, or we can override them.
And so if we override them and for example,
use KMS using the managed key aws/s3 KMS key,
and click on upload.
And now we have a look at the file itself.
So let's click on it
and scroll down to the encryption block.
Here we go.
As you can see now,
even though default encryption is enabled,
this file was encrypted using SSE KMS,
and the KMS key that we specified.
So remember the default encryption
is not applying the same encryption to all files.
It is just making sure that if you upload the object
in an unencrypted way,
then you will automatically be encrypted using the default
encryption mechanism. So that's it for this lecture.
I hope you liked it.
And I will see you in the next lecture.