Skip to main content

S3 Buckets Should Have Default Encryption Enabled

More Info:​

S3 buckets should have default encryption (SSE) enabled or use a bucket policy to enforce it. S3 default encryption will enable Amazon to encrypt your S3 data at the bucket level instead of object level in order to protect it from attackers or unauthorized personnel.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of S3 Buckets not having default encryption enabled in AWS:

  1. Log in to the AWS Management Console.
  2. Go to the S3 service dashboard.
  3. Click on the bucket for which you want to enable default encryption.
  4. Click on the "Properties" tab.
  5. Scroll down to the "Default encryption" section and click on "Edit".
  6. Select "AES-256" or "AWS-KMS" as the default encryption option.
  7. If you choose "AWS-KMS", select the KMS key that you want to use for encryption.
  8. Click on the "Save" button to save the changes.

After following these steps, the S3 bucket will have default encryption enabled, and all objects stored in the bucket will be encrypted with the selected encryption option.

Using CLI

To remediate the misconfiguration of S3 Buckets not having default encryption enabled in AWS, you can follow the below steps using AWS CLI:

  1. Open the AWS CLI on your system.

  2. Check if the S3 bucket has default encryption enabled or not using the following command:

    aws s3api get-bucket-encryption --bucket <bucket-name>

  3. If the response shows that default encryption is not enabled, then you can enable it using the following command:

    aws s3api put-bucket-encryption --bucket <bucket-name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'

    This command will enable default encryption for the specified S3 bucket using AES256 encryption.

  4. Verify that default encryption is enabled on the S3 bucket using the following command:

    aws s3api get-bucket-encryption --bucket <bucket-name>

    The response should show that default encryption is enabled on the S3 bucket.

By following the above steps, you can remediate the misconfiguration of S3 Buckets not having default encryption enabled in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of S3 buckets not having default encryption enabled in AWS using Python, you can follow these steps:

  1. Install the AWS SDK for Python (Boto3) using pip:
pip install boto3

  1. Configure AWS credentials using the AWS CLI or by setting environment variables.

  2. Write a Python script to enable default encryption for all S3 buckets in your AWS account:

import boto3

# Create an S3 client
s3 = boto3.client('s3')

# Get a list of all S3 buckets in your account
buckets = s3.list_buckets()['Buckets']

# For each bucket, check if default encryption is enabled
for bucket in buckets:
    bucket_name = bucket['Name']
    bucket_encryption = s3.get_bucket_encryption(Bucket=bucket_name)
    
    # If default encryption is not enabled, enable it
    if 'ServerSideEncryptionConfiguration' not in bucket_encryption:
        s3.put_bucket_encryption(
            Bucket=bucket_name,
            ServerSideEncryptionConfiguration={
                'Rules': [
                    {
                        'ApplyServerSideEncryptionByDefault': {
                            'SSEAlgorithm': 'AES256'
                        }
                    }
                ]
            }
        )
  1. Run the Python script to enable default encryption for all S3 buckets in your AWS account.

Note: This script will enable default encryption using AES256 algorithm. If you want to use a different encryption algorithm, you can modify the script accordingly.

Using Terraform
resource "aws_s3_bucket" "THIS_BUCKET" {
  bucket = "YOUR_BUCKET_NAME"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "THIS_BUCKET_ENCRYPTION" {
  bucket = aws_s3_bucket.THIS_BUCKET.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

This enables default SSE-S3 (AES256) encryption for all new objects in the bucket and will overwrite any existing default encryption configuration, but it does not force bucket replacement.

To verify, terraform plan should show creation (or update) of aws_s3_bucket_server_side_encryption_configuration.THIS_BUCKET_ENCRYPTION with sse_algorithm = "AES256" and no replace of the bucket.

Additional Reading:​