Starting weeks following November 2025 announcements, Amazon S3 began automatically disabling SSE-C encryption by default for all new general purpose buckets and for new writes on existing buckets without SSE-C objects. This change affects 37 AWS regions, including China and GovCloud.
Buckets with existing SSE-C encrypted objects remain unchanged to preserve data accessibility. This update promotes security best practices by reducing complexities and risks associated with customer-managed encryption keys and aligns default encryption settings towards more managed AWS options.
Source & further reading
Amazon S3 starts rolling out new security best practice to new and existing buckets by default ↗Source published 2026-04-06. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.