With the UpdateObjectEncryption API, users can switch encrypted objects' server-side encryption between SSE-S3 and SSE-KMS or change customer-managed KMS keys. This feature supports all object sizes and storage classes, enabling compliance with encryption policies and key rotation without copying data.
The capability is compatible with S3 Batch Operations for large-scale transformations and maintains existing lifecycle configurations. This advancement addresses customer needs around data security and audit readiness, though independent security assessments are not discussed in the source.
Source & further reading
Change the server-side encryption type of Amazon S3 objects ↗Source published 2026-01-29. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.