Understanding S3 Default Encryption and Bucket Policies: Key Differences Explained

·May 26, 2025·

4 min read

Cover Image for Understanding S3 Default Encryption and Bucket Policies: Key Differences Explained

Arjun had set up an S3 bucket to store customer documents. He was confident everything was secure… until his teammate asked:

“Did you enforce encryption for every file uploaded?”

Arjun paused.

He remembered S3 supports default encryption, but he also saw something called bucket policies that enforce encryption. So, which should he use? Are they the same? Here's what he figured out.

🧱 What is Default Encryption?

Default Encryption is like a fallback safety net.

✅ It automatically encrypts any object uploaded without encryption settings.
✅ Uses SSE-S3 (Amazon S3-managed keys) by default.
🔄 Can be changed to use SSE-KMS instead if you want KMS-level control.

Arjun realized: “This helps make sure nothing gets stored unencrypted — but only if someone doesn’t specify encryption at all.”

📜 What is a Bucket Policy that Enforces Encryption?

Bucket Policies can be more strict. They let you control behaviour at the API request level.

❌ You can reject uploads that don’t include encryption headers.
✅ You can force SSE-KMS or SSE-C — even if someone tries to bypass the default encryption.

Here’s what Arjun saw in action:

{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::my-bucket-name/*",
  "Condition": {
    "StringNotEquals": {
      "s3:x-amz-server-side-encryption": "aws:kms"
    }
  }
}

This says: “If someone uploads a file without SSE-KMS, deny it — even if default encryption is set.”

🧠 Key Differences (SAA Tip Table)

Feature	Default Encryption	Bucket Policy
Auto Encrypts	✅ Yes, if no encryption specified	❌ Doesn’t auto encrypt — just blocks
Can Force Specific Type	❌ No (just uses configured type)	✅ Yes — can require SSE-KMS or SSE-C
Applied When?	During object storage	During the API request
Can Deny Requests?	❌ No	✅ Yes
Evaluation Priority	👇 Happens after bucket policy	👆 Happens first

✅ Conclusion:

Default Encryption only applies after a request is allowed.
If your bucket policy denies unencrypted uploads, default encryption won’t get a chance to act.

🔐 Best Practice:

If you're enforcing encryption via bucket policy, always require clients to include the correct headers in their API calls:

x-amz-server-side-encryption: AES256 → for SSE-S3
x-amz-server-side-encryption: aws:kms → for SSE-KMS

🔐 What Arjun Now Does:

✅ Uses Default Encryption (SSE-KMS) to ensure all uploads are encrypted by default.
✅ Adds a Bucket Policy to enforce use of SSE-KMS explicitly.
✅ Feels confident — knowing nothing can sneak through unencrypted.

🧠 SAA Exam Tip

Default encryption protects you silently, but bucket policies give you enforcement control.
If the question asks about forcing a specific encryption method, the answer is: Use a bucket policy.