Re:Why Amazon S3 server side encryption (SSE-S3) is misleading
by paranoidrobot on Monday January 16, 2023 @05:04PM
(#34406063)
It's protection against mistakes where you've accidentally granted more access than was intended.
For instance, if someone does a wildcard resource "acme-prod-widget-*" for a new policy, but forgets that widget also has (say) a customer-pii bucket, too.
Well, if acme-prod-widget-customer-pii is encrypted with a customer-pii specific KMS key, then there's no accidental leak of that data.
For instance, if someone does a wildcard resource "acme-prod-widget-*" for a new policy, but forgets that widget also has (say) a customer-pii bucket, too.
Well, if acme-prod-widget-customer-pii is encrypted with a customer-pii specific KMS key, then there's no accidental leak of that data.