On AWS, data at rest is encrypted for you in many places, but the key owner differs. S3 applies SSE-S3 to every new object by default. If you need your own access control, audit trail or revocation, choose a customer managed KMS key and set its key policy and rotation deliberately.
What does AWS encrypt without being asked?
For Amazon S3, the user guide states that server-side encryption with S3 managed keys (SSE-S3) is the base level for every bucket, and that all new object uploads have been encrypted automatically since January 5, 2023. You do not pay extra and you do not configure anything.
That is a useful floor. It is not the same as control. With SSE-S3 the key is managed by the service. You cannot write a policy that says "only this role may decrypt" at the key level, and you cannot disable the key to cut off access.
Which S3 encryption option fits which need?
The same guide lists the alternatives for data at rest:
- SSE-S3: default, no setup, no key-level controls for you.
- SSE-KMS: objects are encrypted under an AWS KMS key. Access needs both S3 permission and permission to use the key.
- DSSE-KMS: dual-layer server-side encryption with KMS keys, for cases that call for two layers.
- SSE-C: you supply the key with each request. You carry the key handling burden.
- Client-side encryption: you encrypt before upload, so the service never sees plaintext.
Changing a bucket default to SSE-KMS does not re-encrypt objects already there. AWS documents S3 Batch Operations with the Copy action as the way to rewrite existing objects under the new setting.
What are the three KMS key types?
The KMS developer guide describes customer managed keys, AWS managed keys and AWS owned keys. Customer managed keys are the ones you create and manage. AWS managed keys are described as a legacy type that is no longer created for new services as of 2021. AWS owned keys sit in an account managed by the service and let services encrypt by default.
The practical reading: if a service quietly encrypts with an AWS owned key, you get encryption but no key policy of your own. If you want a say, you need a customer managed key.
How does envelope encryption work in KMS?
KMS can return a data key both in plaintext and encrypted under your KMS key. Your application encrypts the data locally with the plaintext key, stores the encrypted copy of the key next to the data and discards the plaintext. To read the data later, it asks KMS to decrypt the data key. The AWS cryptographic details whitepaper describes this as customer data keys, with rotation and use controlled by the application.
This matters for large objects and for performance. KMS never has to see your data, only the small key.
How does key rotation behave?
Per the KMS guide, automatic and on-demand rotation are supported for customer managed keys only. Automatic rotation applies to symmetric encryption keys whose key material AWS KMS generated. If you enable it and give no period, the default rotation period is 365 days, and you can set a custom period. The kms:RotationPeriodInDays condition key can limit what values people are allowed to choose.
AWS recommends on-demand rotation for unplanned events and automatic rotation with a custom period where possible. Rotation changes only the current key material, and KMS decrypts older ciphertext with the key material that encrypted it. It is not a substitute for tight key policy.
Constructed example
A team stores invoices in one bucket and ML training exports in another. Invoices go under a customer managed key whose policy allows only the billing service role and an audit role. The ML bucket stays on SSE-S3 because the data is non-sensitive and the team wants no extra moving parts. When a contractor leaves, the team removes the contractor role from the invoice key policy. No object needs to be touched.
What to do
- Inventory buckets and note which use SSE-S3, SSE-KMS or SSE-C.
- Decide which data classes need key-level control and move those to customer managed keys.
- Write least privilege key policies. Separate who can administer a key from who can use it.
- Enable automatic rotation and choose a rotation period you can justify.
- Use S3 Batch Operations to re-encrypt existing objects after changing a default.
- Review CloudTrail for key usage so you can answer "who decrypted this and when".
Quick check
Is my S3 data encrypted if I never enabled encryption?
Yes for new objects uploaded since January 5, 2023, using SSE-S3 by AWS documentation. Older objects should be checked, and you should confirm what your bucket default says.
Does rotating a KMS key re-encrypt my old data?
No. Rotation changes only the current key material. When you decrypt, KMS automatically uses the key material that encrypted the data, so old ciphertext keeps working.
Sources
- Protecting data with encryption, Amazon S3 User Guide
- AWS KMS keys, AWS KMS Developer Guide
- Rotate AWS KMS keys
- AWS KMS Cryptographic Details
Last reviewed: 18 October 2026.
