The service can encrypt an object at rest with a key that the user supplies in each request and that the service does not retain, as distinct from a key referenced from a key management service, so the object can only be read by presenting the same key again.
Customer-Provided Encryption Keys
CCC.ObjStor.CP14
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.TH04 | Objects are Encrypted with Keys Outside Organizational Control | An identity with write access may store or re-encrypt objects using a customer-provided key that the service does not retain, or a key held in a key management service outside the organization's control. The service then holds ciphertext it cannot decrypt on the organization's behalf, so the plaintext is available only to the holder of the foreign key. This results in a loss of availability of the affected data and, where the key holder is external, a loss of confidentiality. |