Amazon SES integrates with AWS Key Management Service (KMS), which provides the ability to encrypt the mail that it writes to your Amazon S3 bucket. Amazon SES uses client-side encryption to encrypt your mail before it sends the email to Amazon S3. This means that it is necessary for you to decrypt the content on your side after you retrieve the mail from Amazon S3. The AWS Java SDK and AWS Ruby SDK provide a client that is able to handle the decryption for you.