Data encryption in Amazon S3 - Amazon Transfer Family
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Data encryption in Amazon S3

Amazon Transfer Family uses the default encryption options you set for your Amazon S3 bucket to encrypt your data. When you enable encryption on a bucket, all objects are encrypted when they are stored in the bucket. The objects are encrypted by using server-side encryption with either Amazon S3 managed keys (SSE-S3) or Amazon Key Management Service (Amazon KMS) managed keys (SSE-KMS). For information about server-side encryption, see Protecting data using server-side encryption in the Amazon Simple Storage Service User Guide.

The following steps show you how to encrypt data in Amazon Transfer Family.

To allow encryption in Amazon Transfer Family

  1. Enable default encryption for your Amazon S3 bucket. For instructions, see Amazon S3 default encryption for S3 buckets in the Amazon Simple Storage Service User Guide.

  2. Update the Amazon Identity and Access Management (IAM) role policy that is attached to the user to grant the required Amazon Key Management Service (Amazon KMS) permissions.

  3. If you are using a session policy for the user, the session policy must grant the required Amazon KMS permissions.

The following example shows an IAM policy that grants the minimum permissions required when using Amazon Transfer Family with an Amazon S3 bucket that is enabled for Amazon KMS encryption. Include this example policy in both the user IAM role policy and session policy, if you are using one.

{
	"Sid": "Stmt1544140969635",
	"Action": [
		"kms:Decrypt",
		"kms:Encrypt",
		"kms:GenerateDataKey"
	],
	"Effect": "Allow",
	"Resource": "arn:aws-cn:kms:region:account-id:key/kms-key-id"
}
Note

The KMS key ID that you specify in this policy must be the same as the one specified for the default encryption in step 1.

Root, or the IAM role that is used for the user, must be allowed in the Amazon KMS key policy. For information about the Amazon KMS key policy, see Using key policies in Amazon KMS in the Amazon Key Management Service Developer Guide.