Data can be encrypted in S3 using SSE-S3, SSE-C, SSE-KMS.
SSE-S3 provides the solution S3 oversees Key management and protection using multiple layers of security.
SSE-C lets S3 perform encryption and decryption of data and control the key used for encryption. Key management and storage are implementation-dependent and not provided by AWS.
SSE-KMS uses the Amazon Key Management service to store the keys used in encryption. KMS also provides an additional layer of security by keeping master keys. Special permission is needed to be able to use the master key.
