Amazon S3 Encryption - Client-Side Encryption (CSE) | Overview.

Amazon S3 Encryption – Client-Side Encryption (CSE)

Scope:

• Intro,
• How Client-Side Encryption Works,
• Methods of Client-Side Encryption,
• Advantages of Client-Side Encryption,
• Disadvantages and Limitations,
• When to Use Client-Side Encryption,
• Sample Encryption with AWS SDK for Java,
• Using the Amazon S3 Encryption Client (Java SDK v1),

Intro:

• Client-Side Encryption (CSE) in Amazon S3 means that twtech encrypt its data before uploading it to S3, and decrypt it after downloading, using keys and tools  that twtech manages.

NB:

• AWS never sees twtech plaintext data or its keys.

 How Client-Side Encryption Works

1. Before Upload (Encrypt):
• twtech application encrypts the data using a client-side encryption library and a key its control.
• The encrypted data is then uploaded to S3.
2. After Download (Decrypt):
• The encrypted object is retrieved from S3.
• twtech application uses the key to decrypt it locally.

NB:

• AWS S3 simply stores and serves encrypted data;
• AWS S3  doesn’t perform any encryption or decryption on twtech behalf.

 Methods of Client-Side Encryption

Method	Description
AWS SDK Client-Side Encryption (CSE-KMS / CSE-C)	AWS SDKs (e.g., Java, .NET) support envelope encryption using either: – AWS KMS-managed keys – Customer-supplied keys (CSE-C)
Custom encryption libraries	twtech can use tools like: – OpenSSL – HashiCorp Vault – twtech own encryption algorithm
S3 Encryption Client	SDK-provided utility to simplify client-side encryption and decryption workflows

 Advantages of Client-Side Encryption

Benefit	Explanation
Maximum control	twtech retains full control of encryption keys and logic.
Zero trust in AWS	AWS never sees or handles your unencrypted data.
Flexible key storage	twtech can store keys locally, in HSMs, or with its own key management systems.
Layered security	Can be used in addition to SSE for defense-in-depth.

Disadvantages and Limitations

Limitation	Explanation
Key management overhead	twtech musts manage key generation, rotation, storage, and security.
Compatibility	Incompatible with some S3 features like: – S3 Select – Object Lock – Server-side features (e.g., default encryption policies)
No AWS auditing	Since AWS doesn’t handle the keys or encryption, twtech can’t use CloudTrail for key access logging.
More complex development	twtech application must handle all encryption logic and potential error handling.
Increased client-side processing time	Slight performance cost due to local encryption/decryption.

 When to Use Client-Side Encryption

Use Client-Side Encryption if:

• twtech compliance policies prohibit trusting third-party key management, including AWS KMS.
• twtech wants to enforce end-to-end encryption and have robust internal key management.
• twtech is building security-sensitive applications (e.g., banking, medical, or military).

 Sample Encryption with AWS SDK for Java

# Using the Amazon S3 Encryption Client (Java SDK v1):

#  java

// Create a master key provider using AWS KMS

KmsMasterKeyProvider keyProvider = new KmsMasterKeyProvider("alias/twtechKmsKey"); 

// Create an S3 encryption client

AmazonS3Encryption s3EncryptionClient = AmazonS3EncryptionClientBuilder.standard()

        .withEncryptionMaterials(new KMSEncryptionMaterialsProvider(keyProvider))

        .withRegion(Regions.US_EAST_2)

        .build();

// Upload encrypted object

PutObjectRequest request = new PutObjectRequest("twtech-s3bucket", "encrypted-object", new File("twtech-file.txt"));

s3EncryptionClient.putObject(request);