Client-side encryption is the act of encrypting your data locally to ensure its security as it passes to the Amazon S3 service. Amazon S3 receives your encrypted data; it does not play a role in encrypting or decrypting it ( but you can also use kms created keys)

When enabling Encryption, only new files will be encrypted - this means if you need encryption for old objects, you will have to re-upload them.