Client-side encryption is a technique to encrypt data before transmitting the data to the Amazon S3 server.
You can read a client-side encrypted file in an Amazon S3 bucket. To read client-side encrypted files, you must provide a master symmetric key or customer master key in the connection properties. The Secure Agent decrypts the data by using the master symmetric key or customer master key.
When you generate a client-side encrypted file using a third-party tool, metadata for the encrypted file is generated. To read an encrypted file from Amazon S3, you must upload the encrypted file and the metadata for the encrypted file to the Amazon S3 bucket.
You require the following keys in the metadata when you upload the encrypted file:
Content-Type
x-amz-meta-x-amz-key
x-amz-meta-x-amz-unencrypted-content-length
x-amz-meta-x-amz-matdesc
x-amz-meta-x-amz-iv
Reading a client-side encrypted file
Perform the following tasks to read a client-side encrypted file:
Provide the master symmetric key when you create an Amazon S3 V2 connection.
Ensure that you provide a 256-bit AES encryption key in Base64 format.