Highly sensitive case files must be encrypted in the application before PutObject so AWS never sees plaintext, while ordinary park-photo buckets can use SSE-S3 or SSE-KMS. What contrast should developers apply?
Select an answer to reveal the explanation.
Short Explanation
Client-side encryption locks the briefcase before it leaves city hall—AWS stores ciphertext only. SSE locks it in the AWS vault after upload. Pick client-side when policy says the cloud must never see plaintext.
Full Explanation
Client-side encryption means the application encrypts data before PutObject, so AWS receives and stores ciphertext. Server-side encryption (SSE-S3 or SSE-KMS) encrypts objects at rest after AWS accepts them. Sensitive case files that must never appear as plaintext to AWS need client-side encryption; other municipal assets can use SSE. Bucket ACLs alone are not encryption.