Configure encryption in S3Client

S3Client uses server-side encryption from the S3 API. The service encrypts data at rest; S3Client supplies parameters and, for SSE-C, the key needed for the request. This encryption is separate from transport TLS and the local credential vault.

You can set the bucket’s default encryption, choose encryption for an object to write or copy, and supply a temporary key to read an SSE-C object. These settings create neither KMS keys nor permissions on the service.

An encryption change that rewrites the object by copying follows S3 copy conditions. Disabling the applicable source condition removes that protection against content changes during the copy. An update without copying remains independent.

Check capabilities and permissions#

Open File > Accounts…, select the account and click Edit…, then open Capabilities > Encryption. The SSE-S3, SSE-KMS, DSSE-KMS and SSE-C modes, bucket configuration operations and Update object encryption without copying must reflect the service’s support. Then open Capabilities > Encryption policies. The Features tab specifies the operations and parameters accepted by the policy selected under Policy. Account default policy and the Assignments tab determine which policy applies to each location.

The policy distinguishes single writes, multipart initiation, copies, SSE-C reading, writing and copy-source operations, KMS context and Bucket Keys. SSE-C multipart also requires compatible part operations. Enabling a capability does not replace these settings.

S3 read and write permissions are still required. KMS also requires appropriate authorization, including kms:Decrypt for reading and kms:GenerateDataKey for writing. An in-place update requires s3:UpdateObjectEncryption and the KMS permissions in the AWS UpdateObjectEncryption reference. KMS and SSE-C require HTTPS; S3Client requires Signature Version 4 for KMS and presigned SSE-C URLs.

Choose parameters#

Choices depend on the context. A specific version allows Do not modify and a compatible in-place SSE-KMS transition; other modes remain unavailable. A bucket offers its default modes. In Change encryption, the KMS settings and New SSE-C key groups stay in place, with only applicable fields enabled. Switching modes keeps your entries, but only parameters for the selected mode are applied.

For objects and transfers, Change encryption… opens the Change encryption dialog. Choose New encryption:, then click Use settings. This prepares the change without sending a modification request. Cancel in this dialog restores the last confirmed choice. The operation starts when you confirm the properties or transfer in the main dialog.

In KMS key:, supply a reference accepted by the service for the selected operation. A copy can use an ID, ARN or alias if the service allows it; an in-place update requires a full key ARN, not an alias or a simple ID. Use a key compatible with the destination region and account. An empty reference, when allowed, lets the service choose its default key.

Confirming KMS key favorites saves favorites in the account; canceling properties or the transfer afterward does not undo them.

Favorites… opens KMS key favorites. Add prepares Label: and KMS key reference:; Rename changes the label and Remove removes the favorite. Confirm Add KMS favorite or Rename KMS favorite with OK, then select the favorite and click OK in KMS key favorites to save changes and insert its reference into KMS key:. Cancel in this last dialog discards changes to favorites. Favorites store a reference, not the secret, and do not create a KMS key.

KMS context: offers:

• Unspecified: sends no additional context. An update without copying keeps the existing context; a copy or upload with an explicitly selected KMS mode adds no user-provided context.
• No additional context: explicitly selects an empty additional context. Changing an existing object’s encryption with this choice requires a copy.
• Provide JSON context: a JSON object whose values are all strings, limited to 8 KiB in UTF-8.

In single-object and multiple-object properties, Modify child objects, and Paste with options, the initial choice is Unspecified. Switching encryption modes does not replace that choice. The Make current recovery dialog uses a different editor: explicitly choosing SSE-KMS or DSSE-KMS there can select No additional context.

S3 does not return the source object’s KMS context. With Reuse source settings, Unspecified leaves that decision unresolved: if a KMS source is encountered, S3Client asks for its context or an explicit No additional context choice. To reuse an existing context, supply it yourself. The context field is absent from bucket default encryption settings and disabled when updating a specific version.

Under KMS settings, Bucket Key: applies only to SSE-KMS. Paste with options labels this field Bucket Key for destination objects:. Unspecified, the initial choice, sends no explicit choice; Disabled or Enabled sends the requested value. The bucket uses Bucket Key for new objects: and loads its remote value when readable. Available choices depend on the policy applied to the bucket and the selected operation.

Supply an SSE-C key#

Retain your key before writing: S3Client does not save it in the account as a persistent read key. Losing it prevents reading the corresponding objects.

1. In Change encryption, choose SSE-C under New encryption:. The New SSE-C key group becomes available.
2. Choose Base64 (the default) or Hexadecimal under Encoding:, then enter the key in Key: using that format.
3. You can use Import file… for a binary file containing exactly 32 bytes.
4. Click Use settings. An invalid key prevents confirmation and leaves the dialog open.

The key is temporary for the operation. Its MD5 displayed in properties is not the key and cannot recover it.

To read an existing object, open Properties > Encryption > Read key…. The initial choice is No SSE-C key. Choose Temporary SSE-C key, supply the key, then use Reload properties. It is used for that object’s properties and download. Download… uses this target; first choose a local destination in the other pane.

The SSE-C read key dialog shows the target and, for a specific version, Version:. The read key decrypts the source; it does not select destination encryption. To remove a key, choose No SSE-C key, then confirm. Reading SSE-C properties requires HTTPS, the SSE-C capability, and Encryption policies > Features > SSE-C operations > SSE-C reading > Read object metadata. It is unavailable for directory buckets. These settings are separate from permissions on the service.

Bucket default encryption#

Bucket default encryption applies to future writes. Changing or deleting configuration does not decrypt existing objects. Usual permissions are s3:GetEncryptionConfiguration and s3:PutEncryptionConfiguration; Amazon S3 also uses the latter for deletion.

This tab applies to a single General purpose bucket. Changing its default encryption or SSE-C blocking first requires a successful read of a configuration S3Client can interpret. Deleting the entire document depends separately on the Remove bucket encryption configuration capability.

Current configuration shows the last state read from the service. Pending change summarizes only your prepared changes and initially shows No change. Use settings does not change remote state: the settings are sent when you click OK in the bucket properties. Cancel in the properties discards them.

1. In the S3 pane, select a single bucket and open Properties > Encryption.
2. Read Current configuration, including Mode:, KMS key:, Bucket Key: and SSE-C blocking:.
3. Click Change encryption….
4. To change the default mode, select Change default encryption, then choose an available Encryption: mode: SSE-S3, SSE-KMS or DSSE-KMS. Fill in KMS key: and Bucket Key for new objects: as needed.
5. Under SSE-C access > SSE-C blocking:, choose Keep SSE-C blocking unchanged, Block new SSE-C writes or Allow new SSE-C writes. The latter two require support in the policy.
6. Click Use settings and check Pending change. Current configuration still shows the state read from the service.
7. Click OK in the bucket properties to apply the change.
8. Once the operation finishes, reopen Properties > Encryption to verify remote state.

Blocking affects new writes, not deletion of stored SSE-C objects. You can change blocking alone without selecting Change default encryption. To delete the entire document, select Delete remote encryption configuration, click Use settings, then OK in the properties. Deletion includes SSE-C blocking; service defaults still apply. Selecting this checkbox disables other settings without clearing them: clear it to restore those settings before confirming.

No explicit encryption configuration was returned. The service still applies its defaults. does not indicate unencrypted objects. Not reported means the value was not supplied. A denied read or a response that cannot be edited without losing settings blocks changes to default encryption and SSE-C blocking. Deletion remains subject to its own capability.

Change an object#

Current encryption presents Mode:, Algorithm:, KMS key:, Bucket Key: and SSE-C key MD5:. Not reported does not mean unencrypted; Not applicable marks a field irrelevant to this mode.

To change the current object’s encryption without copying it, all the following conditions must be met:

• The bucket is a general purpose bucket and supports this update.
• The source object uses SSE-S3 or SSE-KMS.
• The new encryption is SSE-KMS, with a full key ARN.
• KMS context: is set to Unspecified.
• The connection uses HTTPS and Signature Version 4.
• No Object Lock protection blocks the update.

Otherwise, a copy may be necessary. No additional context, even when empty, and Provide JSON context require a copy of the current object. Keep Unspecified to allow an update without copying. The message in Change encryption describes the available path based on the properties read and any other requested changes.

This update preserves the version’s identifier and properties; it can also apply to an archive without restoration.

Other transitions or combined metadata, storage class, ACL or protection changes may require a copy. It requires readable content and may create a version, change the date and incur charges. Large objects may require multipart copying. ACLs and protections to preserve must be readable; hidden grants cannot be copied. Check warnings before applying.

If Enable ACL operations for this account is unchecked, a copy needed for an encryption change uses the destination default without ACL requests or headers. No ACL permission is then required, but preservation of the existing ACL is not guaranteed if the service still uses it. Encryption permissions, content read access and permissions to preserve other properties are still required. See local ACL deactivation.

When Read bucket Object Lock is configured, S3Client must establish its state on the bucket and, if enabled, read the version’s retention and legal hold before determining whether the change can be applied without copying or requires a copy. On Amazon S3, these reads require s3:GetBucketObjectLockConfiguration, s3:GetObjectRetention and s3:GetObjectLegalHold. ObjectLockReadRequired blocks the operation if a required read is denied; correct access and prepare the change again.

These reads also require Read object retention and Read object legal hold. A copy that preserves protection requires the corresponding content capability: Protect server-side copies, Protect multipart uploads, or Protect simple uploads. S3Client refuses a rewrite that cannot preserve observed protection.

1. Choose the target: Show versions off for the current object, or on for a specific version.
2. Open Properties > Encryption; check General > Version ID: if needed.
3. Under Pending change, click Change encryption….
4. Choose New encryption: and its parameters, then click Use settings.
5. Check Pending change, then click OK in the properties and read the confirmations.
6. After an in-place update, reopen the same version and check Current encryption. After a copy, refresh the pane and open the current object or the new version to check the applied encryption.

For an encryption-only change to a specific version, a transition that cannot be applied in place is rejected. If you also change the metadata or storage class of the latest version, S3Client combines the changes in a copy to the current object, after checking that the selected version is still current. The selected encryption applies to that rewrite. A source version with an immutable identifier remains unchanged; with versioning suspended, the null version may be replaced.

Encryption choices for a version remain limited to a compatible in-place transition, with a full KMS key ARN and no additional context. In General, Make current…, Create new version… or Copy as current…, depending on the selected version and the known bucket state, opens a separate copy operation to the current object with its own destination settings. See version recovery.

Change multiple objects or child objects#

In multiple-object properties, the Encryption tab groups the values read by Property, Value and Objects. Different values remain separate, each with its object count. Not reported means the response omitted the value; Not applicable means the field does not apply to that mode. These observations do not select a value to apply.

Pending change > Change encryption… prepares one choice for the selection. Do not modify keeps each object’s encryption unchanged. Use settings confirms the local choice; only OK in the properties starts the changes. The operation examines each object and all requested changes to decide between an update without copying and a rewrite. It does not guarantee the same path for the entire batch.

Source SSE-C key… supplies one key for all selected objects or versions. The dialog identifies the bucket and the number of targets. You can supply this key to read their properties without requesting any changes. Use separate operations for objects encrypted with different keys.

In Modify child objects, Encryption > Pending change > Change encryption… works the same way, with scope determined by the location, object or version mode, and filters. Source SSE-C key: > Provide key… applies to objects inspected by the operation; this button becomes available when you select a change that needs those reads and the account supports them. After Use settings, open Preview, then click Run preview. Check the targets, then click Apply. See object properties and child object changes.

Transfer choices#

In Paste with options, use Destination encryption > Change encryption… to choose New encryption:. Copies offer Reuse source settings, and uploads offer Use service settings, alongside compatible explicit methods. Use settings returns to the transfer options and updates the summary; Copy, Move or Synchronize then starts the selected operation. An incompatible choice remains visible but disabled, with an explanation.

SSE-C read key… in Source decryption supplies the key for all selected sources, including objects inside folders. The dialog identifies the single source and its version, when applicable, or shows the number of selected S3 sources. Use separate operations for different keys. During synchronization, Set destination SSE-C read key… in Destination decryption supplies a separate key used only to read existing destination objects; new writes use Destination encryption.

These choices apply to the operation. See transfer options and child object changes.