title: Do I ever have to decrypt S3-encrypted files?
body: <p>I'm using S3 instead of KMS to store essentially a credentials file, and Python to read the file's contents.</p>
  
  <p>I manually set the file encrypted by clicking on it in S3, going to Properties - Details - Server Side Encryption:AES-256</p>
  
  <p>And in my Python script, I read the key without making changes from when I read the file when it was unencrypted. And I was also able to download the file and open it without having to do anything like decrypting it. I was expecting to have to decrypt it, so I'm a little confused.</p>
  
  <p>I'm just unable to understand what server-side encryption protects against. Would anyone already with access to S3 or the S3 bucket with the key/file be able to read the file? Who wouldn't be able to open the file?</p>