Encryption¶ Simply enough, you do the majority of the above… backwards. Call the generate_data_key KMS API (with the encryption context) to get both an encrypted AES key and decypted AES key. Generete IV’s. Encrypt your data. Assemble all the required metadata (use the KMS provided encrypted AES key for x-amz-key-v2), then push to S3. Jun 05, 2019 · Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256), to encrypt your data. For more information, see Protecting Data Using Server-Side Encryption with Amazon S3-Managed Encryption Keys (SSE-S3).