# Ensure S3 Bucket Default Encryption with KMS Enabled - Source: https://support.icompaas.com/support/solutions/articles/62000218672-ensure-s3-bucket-default-encryption-with-kms-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## **Description:** Server-side encryption is the encryption of data at its destination by the application or service that receives it. AWS Key Management Service (AWS KMS) is a service that combines secure, highly available hardware and software to provide a key management system scaled for the cloud. Amazon S3 uses AWS KMS customer master keys (CMKs) to encrypt your Amazon S3 objects. AWS KMS encrypts only the object data. Any object metadata is not encrypted. You can use these CMKs to protect your data in Amazon S3 buckets. When you use SSE-KMS encryption with an S3 bucket, the AWS KMS CMK must be in the same Region as the bucket. There are additional charges for using AWS KMS CMKs. ## **Rationale:** The encryption context is not secret. It appears in plaintext in AWS Cloud trail logs so you can use it to identify and categorize your cryptographic operations. An encryption context can consist of any keys and values. However, because it is not secret and not encrypted, your encryption context should not include sensitive information. We recommend that your encryption context describe the data being encrypted or decrypted. For example, when you encrypt a file, you might use part of the file path as encryption context. ## **Impact:** By enabling default encryption all new objects are encrypted when they are stored in the bucket. It encrypts an object before saving it to disk and decrypts it when you download the objects. ## **Default Value:**  By default, Default encryption is disabled in S3 buckets. ### **Pre-Requisite:**  - Sign in as admin or IAM user with required permissions - Before implementation steps, you make sure that in KMS encryption key must be there. ## **Test Plan:** - Log in to the AWS Management Console. - Go to S3 console at [https://s3.console.aws.amazon.com/s3](https://s3.console.aws.amazon.com/s3 "https://s3.console.aws.amazon.com/s3"). - In the S3 choose your buckets to examine.![](https://support.icompaas.com/assets/kb/5d7559ffd7f8c599.png) - Go to the **Properties** tab.![](https://support.icompaas.com/assets/kb/3879f3897e4f7809.png) - Scroll down and go to **Default Encryption**  where it may be enabled or disable. ![](https://support.icompaas.com/assets/kb/5a0963d910627f60.png) ### **Via CLI:** Command to list all existing S3 buckets available in your AWS account: aws s3api list-buckets --query 'Buckets\[\*\].Name' To retrieve the server-side encryption configuration for a bucket: aws s3api get-bucket-encryption \\ --bucket ## **Remediation:** ### ### **Implementation Steps:**  - Log in to the AWS Management Console. - Go to S3 console at [https://s3.console.aws.amazon.com/s3](https://s3.console.aws.amazon.com/s3 "https://s3.console.aws.amazon.com/s3") - Select S3 buckets to enable the Default encryption.![](https://support.icompaas.com/assets/kb/1b5cc9893197c644.png) - Go to the **Properties** tab.![](https://support.icompaas.com/assets/kb/371004d3e2f5a70a.png) - Scroll down and go to **Default Encryption** and click on the **Edit** button. ![](https://support.icompaas.com/assets/kb/aeee30bbabe7948c.png) - Click on **Enable radio button** under server-side encryption and select encryption key type AWS Key Management Service key (SSE-KMS). ![](https://support.icompaas.com/assets/kb/d44eef9292bb79d3.png) - Select **AWS KMS** key. ![](https://support.icompaas.com/assets/kb/046936ae672ee049.png) - Click on the **Save changes** button. ### **Via CLI** Enable Default encryption with SSE-KMS using an S3 Bucket Key aws s3api put-bucket-encryption --bucket \\ --server-side-encryption-configuration \\ '{ "Rules": \[ { "ApplyServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "KMS-Key-ARN" }, "BucketKeyEnabled": true } \] }' ## **Backout Plan:** - Log in to the AWS Management Console - Go to the S3 console at [https://s3.console.aws.amazon.com/s3](https://s3.console.aws.amazon.com/s3 "https://s3.console.aws.amazon.com/s3") - Select S3 buckets to disable the Default encryption.![](https://support.icompaas.com/assets/kb/0cf03beee47dc940.png) - Go to the **Properties** tab.![](https://support.icompaas.com/assets/kb/6112256feafa0f87.png) - Scroll down and go to **Default Encryption**  and click on the **Edit** button.**![](https://support.icompaas.com/assets/kb/b1aac583a3de49ee.png)** - Click on **D****isable radio button** under server-side encryption and click on the Save button. ![](https://support.icompaas.com/assets/kb/2c720bb678d90940.png) ### **Via CLI:** To delete the server-side encryption configuration of a bucket aws s3api delete-bucket-encryption \\ --bucket ## **Reference:** [![](https://support.icompaas.com/assets/kb/b10d356a7614f369.png)](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html)[Setting default server-side encryption behavior for Amazon S3 buckets - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html) [![](https://support.icompaas.com/assets/kb/d1f766124d82bc1d.png)Protecting data using server-side encryption with Amazon S3-managed encryption keys (SSE-S3) - Amazon Simple Storage Service](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.