4 ms·
What they won't tell you is that this will use the default KMS key, which cannot be shared across accounts. So your S3 bucket objects cannot be shared across AW
by awoimbee 4y ago
What they won't tell you is that this will use the default KMS key, which cannot be shared across accounts. So your S3 bucket objects cannot be shared across AWS accounts by default, unless you setup a custom KMS key and "copy" everything in place (a standard AWS organisation is made of multiple accounts).
- paranoidrobot 4y agoThe first line of the article reads otherwise, that it's using the AES256 option, which does work cross-account without KMS permissions. > Amazon S3 now automatically applies S3 managed server-side encryption (SSE-S3) as a base level of encryption to all new objects added to S3
- orf 4y agoThat's not correct, this isn't defaulting to SSE-KMS. and it's trivial to share KMS encrypted objects cross-account.