Any bucket created by FSS will always be encrypted using KMS.
For customer-provided buckets, FSS does not modify the existing encryption settings.
The bucket will continue using whatever encryption configuration it already has:
-
If the bucket is already encrypted with KMS (either an AWS-managed key or a customer-managed key), it will remain KMS-encrypted.
-
If the bucket is not encrypted with KMS, FSS will not enable KMS encryption for it.
Configuration bucket
The S3 configuration bucket is always encrypted with KMS by FSS.
Quarantine, Clean, and Failure buckets
For the Quarantine, Clean, and Failure buckets:
-
If you enable the feature but do not provide your own buckets, FSS creates the buckets and enables KMS encryption on them.
-
If you provide your own buckets, FSS does not modify the bucket encryption settings.
FSS - KMS encryption behaviour
|
Scenario
|
FSS behaviour
|
|
Bucket newly created by FSS
|
FSS enables KMS encryption
|
|
Existing bucket previously created by FSS without KMS encryption
|
FSS enables KMS encryption
|
|
Customer-provided bucket without KMS encryption
|
FSS does not enable KMS encryption
|
|
Customer-provided bucket encrypted with an AWS-managed KMS key
|
FSS does not modify encryption settings, and the customer does not need to provide
a key ARN
|
|
Customer-provided bucket encrypted with a customer-managed KMS key (CMK)
|
FSS does not modify encryption settings, and the customer must specify the key ARNs
in the
KMSKeyARNsForBucketSSE parameter. The specified key ARNs will be attached to the related Lambda execution
role permissions. |