private boolean metadataInvolvesSse ( ObjectMetadata metadata ) { if ( metadata == null ) { return false ; } return containsNonNull ( metadata . getSSECustomerAlgorithm ( ) , metadata . getSSECustomerKeyMd5 ( ) , metadata . getSSEAwsKmsKeyId ( ) ) ; }
If SSE - C or SSE - KMS is involved then the Etag will be the MD5 of the ciphertext not the plaintext so we can t validate it client side . Plain SSE with S3 managed keys will return an Etag that does match the MD5 of the plaintext so it s still eligible for client side validation .