Question

A company has an S3 bucket containing 40 TB of existing objects, most of which are currently unencrypted or encrypted with SSE-S3. A new data classification policy requires that all objects—both new and existing—be encrypted with a specific customer managed AWS KMS key. Enabling default bucket encryption with the KMS key has already ensured that newly uploaded objects are encrypted correctly, but the security team confirms the existing objects remain unchanged. Which approach re-encrypts the existing objects with the required KMS key with the least operational effort?

Accepted Answer

Create an S3 Batch Operations job using a copy operation that specifies SSE-KMS with the customer managed key as the destination encryption for all existing objects.

Answer

Enable S3 Bucket Keys on the bucket, which automatically re-encrypts all existing objects with the customer managed KMS key.

Answer

Apply a new bucket policy that denies s3:GetObject unless the object is encrypted with the KMS key, forcing S3 to re-encrypt objects on the next read.

Answer

Turn on S3 default encryption with the KMS key and wait for the daily lifecycle transition process to re-encrypt the objects in place.