# S3 Artifact Encryption

**URL:** <https://forum.buildkite.community/t/s3-artifact-encryption/829>\
**Category:** Elastic CI Stack for AWS\
**Created:** [December 5, 2019, 11:12am UTC](https://forum.buildkite.community/t/s3-artifact-encryption/829 "2019-12-05T11:12:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jufemaiz](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/jufemaiz/32/1693_2.png) [@jufemaiz](https://forum.buildkite.community/u/jufemaiz)\
**Post date:** [December 5, 2019, 11:12am UTC](https://forum.buildkite.community/t/s3-artifact-encryption/829/1 "2019-12-05T11:12:49Z")

</div>

Hi all, looking for some advice on encryption support for S3 artefacts with BYO bucket.

---

<div class="post-metadata">

**Author:** ![pda](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/pda/32/708_2.png) [@pda](https://forum.buildkite.community/u/pda)\
**Post date:** [April 6, 2020, 6:47am UTC](https://forum.buildkite.community/t/s3-artifact-encryption/829/2 "2020-04-06T06:47:49Z")

</div>

Hey Joel. Rather late reply here, but…

By default, artifacts uploaded to your own S3 bucket aren’t encrypted in any way.

You can set `BUILDKITE_S3_SSE_ENABLED=true` in the agent environment to enable S3 Server Side Encryption ([SSE-S3](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html)) using AES256 and Amazon-managed keys. However the agent does not currently support KMS customer-managed keys ([SSE-KMS](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html)) nor [S3 Client Side Encryption](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html).

Alternatively, you can of course encrypt your file(s) before uploading them as artifacts.