S3 Now Encrypts New Objects by Default

From 5 January 2023 Amazon S3 applies server-side encryption with S3-managed keys (SSE-S3) to all new objects automatically, at no extra cost. Existing buckets and objects keep their settings.

Check what a bucket does:

aws s3api get-bucket-encryption --bucket acme-assets-2022
aws s3api head-object --bucket acme-assets-2022 --key backups/db.sql.gz

You still need to choose in some cases:

Need	Use
Encryption at rest, no key management	SSE-S3 (now the default)
Your own key policy, usage audit, grants	SSE-KMS with a customer managed key
Reduced KMS request cost on busy buckets	SSE-KMS with an S3 Bucket Key

aws s3api put-bucket-encryption --bucket acme-assets-2022 \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms","KMSKeyId":"alias/shop-data"},"BucketKeyEnabled":true}]}'

Encryption at rest does not replace access control: keep Block Public Access on and grant access through least privilege IAM policies.