Specifying Server-Side Encryption Using the REST API
At the time of object creation—that is, when you are uploading a new object or making
a
copy of an existing object—you can specify if you want Amazon S3 to encrypt your
data
by adding the x-amz-server-side-encryption header to the request. Set the
value of the header to the encryption algorithm AES256 that Amazon S3
supports. Amazon S3 confirms that your object is stored using server-side encryption
by
returning the response header x-amz-server-side-encryption.
The following REST upload APIs accept the x-amz-server-side-encryption
request header.
When uploading large objects using the multipart upload API, you can specify server-side
encryption by adding the x-amz-server-side-encryption header to the
Initiate Multipart Upload request. When you are copying an existing object, regardless
of whether the source object is encrypted or not, the destination object is not
encrypted unless you explicitly request server-side encryption.
The response headers of the following REST APIs return the
x-amz-server-side-encryption header when an object is stored using
server-side encryption.
Note
Encryption request headers should not be sent for GET requests and HEAD requests if your object uses SSE-S3 or you’ll get an HTTP 400 BadRequest error.
