{"repo":"cloud37/s3-encryption-gateway","free":true,"listed":false,"github":"https://github.com/cloud37/s3-encryption-gateway","clone":"git clone https://github.com/cloud37/s3-encryption-gateway.git","description":"A transparent HTTP proxy that provides client-side encryption for S3-compatible storage services.","language":"Go","stars":27,"topics":["encryption","fips","golang","kubernetes","proxy","s3","backup","data-encryption","data-protection","docker"],"license":"MIT","category":"deployment-docker-iac","readme_excerpt":"S3 Encryption Gateway The Problem Countless applications write data to S3-compatible storage — database backups, log archives, ML training data, CI/CD artifacts — but most of them don't encrypt that data client-side. The real threat isn't a rogue storage provider. Most people reasonably trust their cloud provider and their server-side encryption (SSE). The much more common and practical risk is a misconfigured IAM policy, overly broad bucket policy, accidentally public ACL, or compromised access key . Any mistake at the IAM or policy layer directly exposes your plaintext data — because without client-side encryption, whoever can reach the bucket can read everything in it. By adding a cryptographic layer at the gateway, a configuration mistake in your cloud account no longer immediately translates into a data breach. An attacker who gains unauthorized S3 access — through a policy misconfiguration, a leaked key, or any other account-level compromise — only retrieves ciphertext. They would also need to compromise the gateway — which in a typical deployment never leaves your private network. This is defense-in-depth for object storage: your cloud account's access controls remain your first line of defense; client-side encryption is the second — and it holds even when the first fails. Beyond misconfiguration risk, there are valid reasons to want an independent crypto layer: regulated environments that require customer-managed keys, multi-tenant shared infrastructure, or simply a p","default_branch":null,"files":null,"tree":[],"storefront":"/r/cloud37","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/cloud37/s3-encryption-gateway/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}