Boto encryption key with amazon s3

Question

As I see there with the calls to the set_contents_with_filename or set_contents_with_file , I can set the encryption to true and while to s3, it remains encrypted

I have a few questions

• If possible, I want to know what is the key that is used to encrypt the file.

• If encryption is set to true, does encryption occur on the server side to the right?

• If it is encrypted, at boot, the objects are decrypted in s3 and then start to load? Or does decryption happen at boot?

Answer 1

Two functions that you probably mean are set_contents_from_filename and set_contents_from_file

If possible, I want to know what is the key that is used to encrypt the file.

The current encryption method on the server side is AES256 ( Source ), a key is created on the server side.

If encryption is set to true, does encryption occur on the server side to the right?

Yes, data is downloaded and then encrypted on the server side. If you want, you can also encrypt the data on your client before downloading, but this will mean that for reading you also need to decrypt it on the client. If you do not want to transfer simple data from s3 servers and to s3 server, you can use SSL endpoints

Encrypted, when loaded, objects are decrypted in s3 and then start to load? Or does decryption happen at boot?

After downloading the file using a set of encryption headers, s3 will encrypt your file for storage and decrypt it upon request. The file is saved in an encrypted version on physical media

AWS Blog Workflow Illustration