Reading into the various SSE options on S3, I'm can't understand the following:

What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against?

I can only think of a physical attack vector, where someone physically gets the HDDs used for S3 storage. In that case, why is this encryption optional? Shouldn't it be a mandatory default, handled by AWS entirely for their own purposes?

In other words, what are the attack vectors that this particular solution helps to mitigate?

Thank you!


A number of regulated industries require Encryption at Rest to be compliant with relevant standards (PCI-DSS, HIPPA, etc), so this is providing this tick box.

The attack vectors that this is preventing is anyone with either physical access to the hard-drive, or (if designed correctly) root access to the machine storing the S3 data, from being able to read the data.

As for mandatory by default, AWS does not know the sensitivity of what you are storing. It could be national secrets, or it could be a public readable copy of the compleat works of william shakespeare (out of copyright material). Why should they pay the CPU cost of encrypting/decrypting Romeo and Juliet when it is a public bucket?

  • 1
    And not only "they pay" but also you. There is a measurable speed difference in read/write operations when you include encryption. If I'm writing an IO intensive application with no security concerns, then I'd want the storage unencrypted in order to maximize my IO. What is "little" is a matter of scale, 2 ms per transaction (made up number) isn't much at 100 transaction per minute (0.2 seconds of delay per minute of operation); but at 1 million transactions per minute it gets to be bothersome (you're 1/2 hour backed up in the queue after just the first minute of work)
    – Ruscal
    Jan 16 '19 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.