Aws S3 encryption. Why use it?

Question

I am not into the field at all. I am trying to understand what is the actual use of S3 encryption if the file is decrypted automatically when requested access to it.

Anyone with permissions to access the file can get the file.

Others with no permissions cannot access the file in the first place.

Basically that is how I see it.

How could one get the file at all without access permission to the S3 bucket?

Edit: The question came out of reading whitepapers regarding hipaa compliance.

Is an S3 bucket considered hipaa compliant if S3 bucket is not encrypted and access to the bucket is possibile only to services running inside the corresponding aws account.

Answer 1

Hypothetically speaking, imagine if a rogue Amazon employee bypassed the normal access restrictions and got physical access to your S3 storage media. They would have access to your cleartext data. There are various unfortunate scenarios that I could think of that might put your unencrypted data at risk of exposure. This is why S3 encryption at-rest is a very good idea if you feel your data is at all sensitive. By not encrypting at-rest, you are basically giving absolute trust to any individual who comes in physical contact with your data. You should trust nobody.

With that said, if you truly are dealing with sensitive data being stored in S3, you SHOULD NOT be transmitting this data in the clear at all. If you want to truly be as secure as possible, you should implement client-side encryption of the data, before it is ever sent to S3. On top of this, I would use TLS encryption of the connection to S3. At this point, your data in encrypted before it ever gets to S3, and you can optionally decide whether to turn on S3 server-side encryption for yet another layer of encryption, because why not? It's free to do so, right?

I'll admit I'm not a HIPPA expert - it's not something I personally have to deal with, but I do understand the nature of securing sensitive customer data. If you are in a position to be responsible for such things, then I don't know why you wouldn't default to using the most layers of security possible. Only trying to do the bare minimum is how companies end up in the news headlines due to "unexpected" (negligent) data leaks. Don't be the person responsible for bad news headlines for your company. Secure your sensitive data as much as possible, and certainly as much as is required.

Answer 2

S3 encryption is largely a tick in the compliance checkbox for PCI / HIPPA and similar standards. It prevents anyone who gets access to the physical media accessing your data, which while possible is extremely unlikely given the physical controls and media disposal that AWS uses.

If the same company that holds your data also holds the encryption keys then they can decrypt your data. AWS no doubt has significant controls that prevents employees getting access to both encryption keys and data, but nothing is perfect and all software has bugs.

As @guzzijason says, if your data is critical then you should encrypt your data before it is sent to S3. If you're running your servers in EC2 they're still AWS controlled, but at least it's another layer of encryption and another hoop to jump through for an attacker to access the data.

There's no reason not to encrypt your data in S3, as it does increase security - the only question is by how much.

2021 update - encryption does also incur KMS costs, but using S3 bucket keys can reduce this cost.