I am not into the field at all. I am trying to understand what is the actual use of S3 encryption if the file is decrypted automatically when requested access to it.

Anyone with permissions to access the file can get the file.

Others with no permissions cannot access the file in the first place.

Basically that is how I see it.

How could one get the file at all without access permission to the S3 bucket?

Edit: The question came out of reading whitepapers regarding hipaa compliance.

Is an S3 bucket considered hipaa compliant if S3 bucket is not encrypted and access to the bucket is possibile only to services running inside the corresponding aws account.

  • 2
    It'll tick off various "encrypted-at-rest" requirements folks have with clients.
    – ceejayoz
    Sep 17, 2018 at 19:49
  • I still don't understand the point of this encryption at rest (where amazon holds the keys) - obviously anything that you don't care at all about, it doesn't matter if it is not encrypted or encrypted at rest, in which case why not use not encrypted - and anything you do care about, then you would do end to end encryption - so why even bother with this encryption at rest option?
    – balupton
    Dec 23, 2020 at 8:36

2 Answers 2


Hypothetically speaking, imagine if a rogue Amazon employee bypassed the normal access restrictions and got physical access to your S3 storage media. They would have access to your cleartext data. There are various unfortunate scenarios that I could think of that might put your unencrypted data at risk of exposure. This is why S3 encryption at-rest is a very good idea if you feel your data is at all sensitive. By not encrypting at-rest, you are basically giving absolute trust to any individual who comes in physical contact with your data. You should trust nobody.

With that said, if you truly are dealing with sensitive data being stored in S3, you SHOULD NOT be transmitting this data in the clear at all. If you want to truly be as secure as possible, you should implement client-side encryption of the data, before it is ever sent to S3. On top of this, I would use TLS encryption of the connection to S3. At this point, your data in encrypted before it ever gets to S3, and you can optionally decide whether to turn on S3 server-side encryption for yet another layer of encryption, because why not? It's free to do so, right?

I'll admit I'm not a HIPPA expert - it's not something I personally have to deal with, but I do understand the nature of securing sensitive customer data. If you are in a position to be responsible for such things, then I don't know why you wouldn't default to using the most layers of security possible. Only trying to do the bare minimum is how companies end up in the news headlines due to "unexpected" (negligent) data leaks. Don't be the person responsible for bad news headlines for your company. Secure your sensitive data as much as possible, and certainly as much as is required.

  • Lets say that physical access to my S3 data is impossibile. Then use of S3 encryption is not in our scope of understanding? Would you agree on that?
    – titus
    Sep 17, 2018 at 21:02
  • Physical access is always possible. It's stored on a physical object that people - vetted people in a secure facility, but people - have physical access to.
    – ceejayoz
    Sep 17, 2018 at 21:05
  • 3
    Saying that "physical access to S3 storage is impossible" is a logical fallacy. I can't agree to that.
    – guzzijason
    Sep 17, 2018 at 21:35
  • = ) yes I am far for worying about that.Then I will accept your answer. Thank you for noticing the question.
    – titus
    Sep 18, 2018 at 22:13

S3 encryption is largely a tick in the compliance checkbox for PCI / HIPPA and similar standards. It prevents anyone who gets access to the physical media accessing your data, which while possible is extremely unlikely given the physical controls and media disposal that AWS uses.

If the same company that holds your data also holds the encryption keys then they can decrypt your data. AWS no doubt has significant controls that prevents employees getting access to both encryption keys and data, but nothing is perfect and all software has bugs.

As @guzzijason says, if your data is critical then you should encrypt your data before it is sent to S3. If you're running your servers in EC2 they're still AWS controlled, but at least it's another layer of encryption and another hoop to jump through for an attacker to access the data.

There's no reason not to encrypt your data in S3, as it does increase security - the only question is by how much.

2021 update - encryption does also incur KMS costs, but using S3 bucket keys can reduce this cost.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .