We are looking to use KMS encryption at-rest and the example for it feels lacking for me to understand it. How do we ensure that the data is encrypted in-flight to AWS S3? I am assuming that the KMS encryption is not magically handling the in-flight encryption. Do we need to pull down a cert from AWS to use as the sslRootCAPath or do we need to still generate our own (Public vs. Internal)? Is the only way to do this switching over to sse-c?
Any help or clarification would be greatly appreciated!
All communication to/from S3 is going to be done over SSL, so the encryption is going to be handled for you. As far as encryption at rest, AWS KMS is going to handle that encryption/decryption on the AWS S3 side to ensure the file is encrypted at rest.