S3 bucket encryption should use SSE-KMS with a customer-managed key

Medium AWS General aws-s3-bucket-encryption

Applies to

AWS::S3::Bucket

What CGPulse checks

A resource passes this rule when sseAlgorithm must not equal AES256. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable SSE-KMS encryption for CloudTrail logs to gain full control over key management. In AWS Console: CloudTrail > Trails > select trail > enable SSE-KMS encryption. See: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html

Terraform

resource "aws_s3_bucket_server_side_encryption_configuration" "{name}" {
  bucket = aws_s3_bucket.{name}.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.{name}.arn
    }
  }
}

Compliance frameworks

Cloud Security: AWS Foundations
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.312(c)(1)
ISO 27001: Information SecurityA.10.1.1
NIST 800-53: Cloud Security ControlsSC-28
PCI DSS v4.03.5.1
SOC 2: Trust ServicesCC6.1

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan