S3 bucket must have server-side encryption enabled

High AWS General aws-s3-bucket-encryption-2

Applies to

AWS::S3::Bucket

What CGPulse checks

A resource passes this rule when encryptionEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable encryption at rest to protect stored data from media compromise. In AWS Console: S3 > Bucket > Properties > Default encryption > enable. See: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html

CLI

aws s3api put-bucket-encryption --bucket "{name}" --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"}}]}'

Terraform

resource "aws_s3_bucket_server_side_encryption_configuration" "{name}" {
  bucket = aws_s3_bucket.{name}.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

Compliance frameworks

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan