Amazon S3 Encryption Client for .NET

The Amazon S3 Encryption Client for .NET provides an easy-to-use Amazon S3 encryption client that allows you to secure your sensitive data before you send it to Amazon S3. The AmazonS3EncryptionClientV2 client automatically encrypts data on the client when uploading to Amazon S3, and automatically decrypts it when data is retrieved. You can use the client just like the regular S3 client, working with things like multipart uploads and the Transfer Utility with no additional code changes required besides swapping out the client used.

The AmazonS3EncryptionClientV2 supports the following encryption methods for encrypting DEKs (Data encryption keys):

• AWS supplied KEK (key encryption key):
  • AWS KMS + Context
• User supplied KEK:
  • RSA-OAEP-SHA1
  • AES-GCM

Object content is encrypted using AES-GCM with generated DEKs which are stored in the S3 object metadata or in a separate instruction file (as configured). The latest version also supports decrypting objects encrypted with comitting AES-GCM algorithm.

Code examples and API Documentation

For more information, including code samples and API documentation, please visit: https://aws.github.io/amazon-s3-encryption-client-dotnet/index.html

Getting Help

We use the GitHub issues for tracking bugs and feature requests and have limited bandwidth to address them.