Up to date all testing with S3A has been with unencrypted objects. This is because our testing has been against Jewel based downstream releases that did not support any of the S3 encryption features. We should begin verifying that S3 encryption features, as invoked by the S3A filesystem client, work correctly with Luminous, as we will want these features to be available in RHCS 3.0
1. Verify SSE-KMS works properly when configured with a Barbican backend.
2. Verify SSE-C works properly
3. Verify per-bucket encryption is supported
4. Verify our bucket policy implementation supports examples in [1]
References:
[1] https://hortonworks.github.io/hdp-aws/s3-encryption/index.html
[2] http://docs.ceph.com/docs/master/radosgw/encryption/