"Password for Encryption" in configuration is not clear

[orblivion]

Encryption password is used to protect your files from reading
by unauthorized persons while in transfer to S3
Encryption password:

What is this password and how would this even work? Is this a password I'm inventing now and keeping to myself or something I register with Amazon? There is no "encryption password" in my aws tool config, and I don't see from a quick look at my AWS console, so I'm assuming the former. But then if Amazon doesn't have this password, it makes no sense to say "while in transfer to S3" because it's going to stay encrypted while on S3. Which means that anybody I work with will need the password to decrypt it. If that's the case, I think it should be reworded.

Is this instead of HTTPS? If so, you should say so, and say that this will obviate the need to use HTTPS, which you ask afterwards, with a default of "No".

All told, this is very confusing, and I don't know what I'm doing when I set this up, or if it is safe to skip.

[zadacka]

I'd agree that this wording is confusing. The fact that the 'password' gets stored in plain-text in the config file also was a bit of a surprise. (s3cmd uses this to suggest your old password to you if you re-configure or re-install it!)

[lddubeau]

I've just started using s3cmd and ran into the exact same confusion. This prompt sets the gpg_passphrase in the configuration file. As far as I can tell, it is used only for client-side encryption. This encryption will protect the data both in transit and at rest. Basically, when using --encrypt (encrypt=True in the configuration file and --no-encrypt is not used) s3cmd uses gpg to encrypt and send encrypted file to the S3 server, or decrypt files after getting them from the server. This entails that someone else who wants to use the data needs the same passphrase.

HTTPS does more than encrypt. It can also check whether the server certificate is valid, which helps prevent man-in-the-middle attacks. Certificate checks are optional, but given that s3cmd puts this in its configuration by default:

check_ssl_certificate = True
check_ssl_hostname = True

It seems that s3cmd can perform the checks. (In case it needs be said, these "ssl" settings pertain to the HTTPS connections.)

[flickerfly]

It was also not clear that I didn't need to set it up. I was bumping around S3 at AWS trying to find something that would coordinate with this question. Then I just skipped it and everything worked which is fine as I'm only dealing with public data at this point anyway.

[joetechem]

So, type in a new password at Encryption password:, leave blank, or is there an encryption password from s3cmd to grab and put in here?

Or should the Encryption password: be something like, Password to be Encrypted:

I agree, it doesn't really make sense here. I'm no expert, but I have a couple certs and I don't understand this bit after running s3cmd --configure

While the s3cmd README doesn't shed too much light here, a tutorial does here: https://www.digitalocean.com/docs/spaces/resources/s3cmd/

--Setting an encryption password is optional, and does not mean encryption will happen right off the bat, just makes it so encryption is available for later use.