# ServerSideEncryption

Indicates whether server-side encryption is enabled for the object, and whether that encryption is from the AWS Key Management Service (AWS KMS) or from Amazon S3 managed encryption (SSE-S3).

- Source: [`aws-s3-deployment/lib/bucket-deployment.ts`](https://github.com/aws/aws-cdk/blob/v2.276.0/packages/aws-cdk-lib/aws-s3-deployment/lib/bucket-deployment.ts#L919)
- Type last changed: v2.185.0 · 19 Mar 2025

## Example

```ts
const websiteBucket = new s3.Bucket(this, 'WebsiteBucket', {
  websiteIndexDocument: 'index.html',
  publicReadAccess: true,
});

new s3deploy.BucketDeployment(this, 'DeployWebsite', {
  sources: [s3deploy.Source.asset('./website-dist')],
  destinationBucket: websiteBucket,
  destinationKeyPrefix: 'web/static', // optional prefix in destination bucket
  metadata: { A: "1", b: "2" }, // user-defined metadata

  // system-defined metadata
  contentType: "text/html",
  contentLanguage: "en",
  storageClass: s3deploy.StorageClass.INTELLIGENT_TIERING,
  serverSideEncryption: s3deploy.ServerSideEncryption.AES_256,
  cacheControl: [
    s3deploy.CacheControl.setPublic(),
    s3deploy.CacheControl.maxAge(Duration.hours(1)),
  ],
  accessControl: s3.BucketAccessControl.BUCKET_OWNER_FULL_CONTROL,
});
```

## Members

| Member | Description |
| --- | --- |
| `AES_256` | 'AES256'. |
| `AWS_KMS` | 'aws:kms'. |
| `AWS_KMS_DSSE` | 'aws:kms:dsse'. |

## Referenced by

- [`BucketDeploymentProps`](/v2/docs/aws-cdk-lib.aws_s3_deployment.BucketDeploymentProps).serverSideEncryption
- [`ProductStackProps`](/v2/docs/aws-cdk-lib.aws_servicecatalog.ProductStackProps).serverSideEncryption