Encryption should happen client-side [1], an S3-to-S3 gateway wouldn&#x27;t help unless you deploy one on all client nodes.
s3cmd and duplicity has support via GPG, but not all S3 clients will know what to do with those files.<p>[1] <a href="http:&#x2F;&#x2F;www.skylable.com&#x2F;blog&#x2F;2014&#x2F;09&#x2F;transparency-reports-server-side-encryption-the-placebo-of-privacy&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.skylable.com&#x2F;blog&#x2F;2014&#x2F;09&#x2F;transparency-reports-se...</a><p>Disclaimer: I&#x27;m co-founder of Skylable