S3 bucket server side encryption should be enabled

Description

Enabling server-side encryption (SSE) on S3 buckets at the object level protects data at rest and helps prevent the breach of sensitive information assets. Objects can be encrypted with S3-Managed Keys (SSE-S3), KMS-Managed Keys (SSE-KMS), or Customer-Provided Keys (SSE-C).

Console Remediation Steps

• Repeat these steps for all impacted S3 buckets.

• Navigate to S3.

• Select the S3 bucket.

• Select the Properties tab.

• Select Default Encryption.

• Select either AES-256 or AWS-KMS encryption and click Save.

CLI Remediation Steps

• Enable AES Encyrption on an S3 Bucket:

  • aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}''

• Enable KMS Encryption on an S3 Bucket:

  • aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms","KMSMasterKeyID":"<key id>"}}]}''

Documentation Links

• How Do I Enable Default Encryption for an S3 Bucket

• put-bucket-encryption Command Line Reference