Ravi Sir's Cards › AWS
Customer CMK or SSE-S3?
This comparison card contrasts Customer CMK or SSE-S3. SSE-KMS (aws): kms header. It also notes key policy + CloudTrail on key use. SSE-S3 (AES256) is described as aES256 managed by S3. It also notes simpler, less key control. The card pairs SSE-KMS with when auditors ask who used which key, and SSE-S3 (AES256) with when SSE-S3 is enough.
Read card text
What this card says
Customer CMK or SSE-S3?
SSE-KMS
aws:kms header; key policy + CloudTrail on key use.
SSE-S3 (AES256)
AES256 managed by S3; simpler, less key control.
Key points
PII / regulated imaging.
Public assets without CMK need.
Example
--sse aws:kms / --sse AES256
Use when
When auditors ask who used which key.
When SSE-S3 is enough.