How to Decrypt S3 content while serving through the Cloudfront.

To serve S3 content encrypted with SSE-C through CloudFront, you can use a Lambda@Edge function to handle the encryption keys. Here's a high-level approach to how you could set this up:

Create a Lambda@Edge Function:

Implement a Lambda@Edge function that will be triggered on viewer request events. This function should:

• Retrieve the encrypted Data Encryption Keys (DEK) for the requested object from your DB or S3.
• Decrypt the DEK using AWS KMS.
• Add the decrypted DEK as the x-amz-server-side-encryption-customer-key header in the request forwarded to S3.

Deploy the Lambda@Edge Function:

Deploy your Lambda@Edge function to AWS Lambda, and associate the function with your CloudFront distribution, and ensure that the function has the necessary permissions to:

• Access the DEKs from your DB/S3.
• Decrypt keys using AWS KMS.
• Write logs to CloudWatch for monitoring and debugging.

Configure CloudFront: Configure your CloudFront distribution to trigger the Lambda@Edge function on viewer request events. Ensure your S3 bucket policy allows access from CloudFront with the necessary SSE-C headers.

If this has answered your question or was helpful, accepting the answer would be greatly appreciated. Thank you!