Amazon S3 has encrypted every new object with SSE-S3 since 5 January 2023, at no extra cost. Choose SSE-KMS or DSSE-KMS when you need to control the key yourself, for example key policies, rotation and per-request audit trails. Be ready for KMS charges and request quotas.
What the default gives you
AWS documentation says S3 applies server-side encryption with S3 managed keys (SSE-S3) as the base level for every bucket. Encryption status shows up in CloudTrail logs, S3 Inventory, Storage Lens and the console.
Two details matter. First, objects uploaded before default encryption applied are not retroactively encrypted by turning it on. Second, if a PUT request carries its own encryption headers, S3 uses those instead of the bucket default.
What you get from the other options
- SSE-S3. Who manages the key: S3. Notes: Default, no added cost.
- SSE-KMS. Who manages the key: You, via AWS KMS. Notes: KMS charges apply, KMS request quotas apply.
- DSSE-KMS. Who manages the key: You, via AWS KMS. Notes: Two layers of server-side encryption.
- SSE-C. Who manages the key: You supply the key per request. Notes: Not supported for default encryption.
With SSE-KMS you can use customer managed keys, which AWS says let you create and control the lifecycle and key policies, with every request logged in CloudTrail. That is the main reason teams pick it: an audit trail of who decrypted what, and a switch you control.
Costs and limits to plan for
- SSE-KMS and DSSE-KMS are subject to KMS requests per second quotas.
- You can enable an S3 Bucket Key to cut KMS request traffic. AWS says Bucket Keys are not supported for DSSE-KMS.
- If you set the default with the PutBucketEncryption API, check the key ID yourself. S3 does not validate it.
- A bucket that receives server access logs must use SSE-S3, otherwise logs may be written with a key you cannot read.
A simple decision guide
- No special requirement beyond encryption at rest: keep SSE-S3.
- Need key policy control, separation of duties or a per-use audit trail: SSE-KMS with a customer managed key.
- A rule or contract demands two layers: look at DSSE-KMS.
- Want to hold the key material outside AWS per request: SSE-C is possible per request but cannot be the bucket default.
What encryption at rest does not do
Server-side encryption protects against someone getting the raw storage. It does not stop a user with valid permissions from reading objects. Access policy is a separate control. See S3 Block Public Access settings explained.
Quick check
Do I need to turn on S3 encryption?
No, SSE-S3 is applied to new objects automatically. You choose a different type only if you need different key control.
Will switching to SSE-KMS re-encrypt my old objects?
No. Changing the default affects new uploads. Existing objects keep how they were encrypted until you rewrite them.
Safeguard's compliance and evidence automation can record encryption settings as audit evidence, and its asset discovery helps find storage you forgot about.
Sources
Last reviewed: 19 October 2026.
