When you enable client-side encryption for Amazon S3 sources, Amazon S3 unloads the data in encrypted format, and then pushes the data to the Secure Agent. The Secure Agent writes the data to the target based on the task or mapping logic.

To enable client-side encryption, you must provide a master symmetric key or customer master key in the connection properties. The Secure Agent encrypts the data by using the master symmetric key or customer master key.