https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html Use an AWS KMS-Managed Customer Master Key (CMK) Use a Client-Side Master Key