Difference between KMS encryption and S3 SSE

Question

如果我 KMS 加密文件并将该文件推送到 S3 存储桶与使用 SSE KMS 加密将文件放入 S3 存储桶有什么区别吗？

Answer 1

First: the KMS Encrypt operation will only accept 4K of data, so it isn't a general solution.

With S3 server-side encryption, the S3 back-end will generate a key, use that key to encrypt the data, use KMS to encrypt the key, then store the encrypted data and the encrypted key. When you read the data it does the reverse: use KMS to decrypt the key, then use the decrypted key to decrypt the data.

You could implement the same thing yourself, storing the encrypted key in the S3 object's metadata. However, this means writing code to do the object encryption yourself, and unless you are familiar with encryption it's possible that you could make a mistake.

There are some limited use-cases for client-side encryption, but in those cases you'd be using an encryption key that's not provided by KMS.