S3 bucket server-side encryption should be enabled

Description

Enabling server-side encryption (SSE) on S3 buckets at the object level protects data at rest and helps prevent the breach of sensitive information assets. Objects can be encrypted with S3-Managed Keys (SSE-S3), KMS-Managed Keys (SSE-KMS), or Customer-Provided Keys (SSE-C).

Console Remediation Steps

• Repeat these steps for all impacted S3 buckets.

  • Navigate to S3.

  • Select the S3 bucket.

  • Select the Properties tab.

  • Select Default Encryption.

  • Select either AES-256 or AWS-KMS encryption and click Save.

CLI Remediation Steps

• Enable AES Encryption on an S3 Bucket:

  • aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'

• Enable KMS Encryption on an S3 Bucket:

  • aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms","KMSMasterKeyID":"<key id>"}}]}'

Documentation Links

• How Do I Enable Default Encryption for an S3 Bucket?

• put-bucket-encryption Command Line Reference