S3 BUCKET ENCRYPTION DOESN'T WORK THE WAY YOU THINK IT WORKS

Summary from the TLDR InfoSec newsletter

S3 Bucket Encryption options all equate to access control more than encryption. In nearly every S3 encryption option (default SSE, KMS, and SSE-C), the user can either download the decrypted file if they have permissions to the encryption material or cannot download the file. Since a user never actually interacts with the encrypted file, the encryption feels more like access control.