I believe all of the AWS S3 SDKs except php support client side encryption, you could also roll your own. In my mind that is more secure then S3 SSE or KMS beca

I believe all of the AWS S3 SDKs except php support client side encryption, you could also roll your own. In my mind that is more secure then S3 SSE or KMS because you are the only one with the key.