S3 Bucket Encryption Doesn't Work The Way You Think It Works (blog.plerion.com) Good overview on how it works and why being compliant does not mean being secure.