I have been tasked with adding application-level file-at-rest encryption to files stored in an S3 bucket and accessed from within a Docker container in ECS.
I have been told that the default server-side encryption of the S3 bucket is insufficient and that I should implement additional encryption of the files at rest at the application level using AES encryption.
We are currently using GPG asymmetric encryption for files coming from upstream and going downstream. Our private key and the downstream application's public key are both obtained from Secrets Manager.
For files at rest, it seems appropriate to use a symmetric key also stored in Secrets Manager.
Anywhere I search, however, it seems that the intended use of AES encryption is typically meant for files that are stored on the server where they are being used. Typically, to my understanding, a passphrase is provided and used to secure a symmetric key stored somewhere on the server by gpg.
Since the application is running within a Docker container, it does not seem appropriate for the key to be stored only on the application server as it would be lost when the container is rebuilt and deployed.
How can I accomplish AES encryption/decryption of the files in the bucket with a pre-existing key that is stored outside the container (i.e. Secrets Manager in this case)?