S3 bucket should use SSE-KMS encryption algorithm

Medium AWS General aws-s3-bucket-encryption-3

Applies to

AWS::S3::Bucket

What CGPulse checks

A resource passes this rule when sseAlgorithm must equal aws:kms. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable SSE-KMS encryption for CloudTrail logs to gain full control over key management. In AWS Console: CloudTrail > Trails > select trail > enable SSE-KMS encryption. See: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html

Terraform

resource "aws_s3_bucket_server_side_encryption_configuration" "{name}" {
  bucket = aws_s3_bucket.{name}.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.{name}.arn
    }
  }
}

Compliance frameworks

Cloud Security: AWS Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan