This script helps you to rotate your CMK(Customer Master Key)
-
We will use this key exclusively for S3 usage
-
Use the AES-256 Encryption while uploading
-
Set the upload header
x-amz-server-side-encryption
and do not specify the key id, forcing S3 to use the default key -
PUT /example-object HTTP/1.1 Host: example-bucket.s3.amazonaws.com Accept: */* Authorization:authorization string Date: Wed, 28 May 2014 19:31:11 +0000 x-amz-server-side-encryption-customer-key:g0lCfA3Dv40jZz5SQJ1ZukLRFqtI5WorC/8SEEXAMPLE x-amz-server-side-encryption-customer-key-MD5:ZjQrne1X/iTcskbY2example x-amz-server-side-encryption-customer-algorithm:AES256
-
Download the objects encrypted