From: <a href="https:&#x2F;&#x2F;aws.amazon.com&#x2F;blogs&#x2F;aws&#x2F;aws-importexport-snowball-transfer-1-petabyte-per-week-using-amazon-owned-storage-appliances&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aws.amazon.com&#x2F;blogs&#x2F;aws&#x2F;aws-importexport-snowball-t...</a><p>&quot;...The data will be 256-bit encrypted on the host [running the Snowball client?] and stored on the appliance in encrypted form. The appliance can be hosted on a private subnet with limited network access.&quot;<p>So I assume the data is encrypted asymetrically.<p>&quot;...ship it back to us for ingestion. We’ll decrypt the data [using the private key specified in the job,] and copy it to the S3 bucket(s) that you specified when you made your request[&#x2F;job]. Then we’ll sanitize the appliance in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization).&quot;<p>That links to <a href="http:&#x2F;&#x2F;nvlpubs.nist.gov&#x2F;nistpubs&#x2F;SpecialPublications&#x2F;NIST.SP.800-88r1.pdf" rel="nofollow">http:&#x2F;&#x2F;nvlpubs.nist.gov&#x2F;nistpubs&#x2F;SpecialPublications&#x2F;NIST.SP...</a><p>There are a few different types of sanitisation (clear&#x2F;purge&#x2F;destroy), and Amazon doesn&#x27;t specify which type. I assume they would go with &quot;clear&quot;, and maybe in a few select places (I&#x27;d hope storage media) &quot;purge&quot;.<p>&quot;Clear&quot; is scary though, as for network devices, it is only &quot;full manufacturer’s reset to reset the router or switch back to its factory default settings&quot;, and for HDD&#x27;s it is &quot;Overwrite media by using organizationally approved and validated overwriting technologies&#x2F;methods&#x2F;tools.  The Clear procedure should consist of at least one pass of writes with a fixed data value, such as all zeros.  Multiple passes or more complex values may optionally be used&quot;.<p>So what vector do you want to protect? Accidental data egress shouldn&#x27;t happen as the data is encrypted. However there are more interesting vectors, such as getting hold of the public key and injecting your own data into another companies buckets...