Question

A company has an S3 bucket containing several million objects that were uploaded over the past three years without server-side encryption. A new compliance requirement mandates that all existing objects must be encrypted at rest with a customer managed AWS KMS key (SSE-KMS). Enabling default encryption on the bucket has only affected new uploads. The security engineer must encrypt the existing objects with the least operational effort while retaining object metadata and versioning history. Which approach should the engineer use?

Accepted Answer

Create an S3 Batch Operations job that invokes a copy operation on the existing objects, specifying SSE-KMS with the customer managed key as the target encryption.

Answer

Enable S3 default encryption with the KMS key and wait for S3 to re-encrypt all existing objects automatically during the next lifecycle transition.

Answer

Attach a bucket policy that denies s3:GetObject on unencrypted objects, forcing clients to re-upload them with encryption headers.

Answer

Enable an S3 Bucket Key on the bucket, which retroactively applies KMS encryption to all previously stored objects at reduced cost.