| Type | What | Use when |
|---|---|---|
| SSE-S3 | AWS manages keys with AES-256 | Default, easy, no audit requirement on encryption |
| SSE-KMS | AWS KMS manages the key | Audit trail, separation of duties, finer access control |
| SSE-C | You provide the key with each request | Compliance requires customer-controlled keys |
| DSSE-KMS | Double-layer KMS encryption | High-security workloads |
| Client-side | Encrypt before uploading | Zero trust on AWS |