Updating encryption on existing Amazon S3 objects with S3 Batch Operations

This article explains how to use S3 Batch Operations with the new UpdateObjectEncryption API to standardize encryption across S3 buckets at scale without data movement.

• UpdateObjectEncryption atomically changes server-side encryption of existing objects regardless of size or storage class
• Preserves object properties, tags, ACLs, and S3 Lifecycle eligibility unlike the previous Copy operation approach
• Enables migration from SSE-S3 to SSE-KMS with customer managed keys and S3 Bucket Keys
• Automatically generates object manifest filtered to target only SSE-S3 encrypted objects
• Generates completion reports for audit and compliance purposes
• Reduces AWS KMS API costs by up to 99% when S3 Bucket Keys are enabled
• Requires IAM role with permissions for KMS operations, manifest generation, and object updates

This solution enables organizations to meet compliance requirements for customer managed encryption without operational complexity or disruption to existing workloads.