A developer uploads a new object to a freshly created S3 bucket using the default AWS CLI settings, without specifying any encryption headers and without configuring a default encryption setting on the bucket. What happens to the object?
- The object is stored unencrypted because no encryption was requested
- The upload fails because encryption must be explicitly configured first
- The object is automatically encrypted with SSE-S3 at no additional cost
- The object is automatically encrypted with SSE-KMS using the account's default key
Correct answer: C. The object is automatically encrypted with SSE-S3 at no additional cost
Since January 5, 2023, Amazon S3 applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every object uploaded to every bucket, automatically and at no additional cost, with no performance impact. This happens whether or not the uploader specifies encryption headers or the bucket has a default encryption setting configured, so the object here is encrypted with SSE-S3 by default. It is never stored unencrypted, so that option describes behaviour S3 no longer allows. The upload does not fail and does not require any prior configuration step, so the option claiming encryption must be set up first is wrong. SSE-KMS is only used when explicitly requested via a header or a bucket default encryption configuration naming a KMS key; without that configuration S3 falls back to SSE-S3, not SSE-KMS, so the fourth option misidentifies which key type is used automatically.
Source: AWS S3 documentation: Using server-side encryption with AWS KMS keys (SSE-KMS) — default SSE-S3 encryption for all new object uploads since January 5, 2023