# Ensure to have backup protection - encryption of backup for S3

- Source: https://support.icompaas.com/support/solutions/articles/62000223805-ensure-to-have-backup-protection-encryption-of-backup-for-s3
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Data encryption is the process of converting raw data into a coded form to help ensure that only authorized parties can read it. Encryption often uses a “key” (usually a large number) stored separately from the data to ensure that only the key holder can read it. Data encryption is often required by regulations as well as internal security standards. AWS has several offerings in the data encryption space.

Within Amazon S3, Server Side Encryption (SSE) is the simplest data encryption option available. SSE encryption manages the heavy lifting of encryption on the AWS side, SSE-S3 is the simplest method to use as encryption keys are handled and managed by AWS. SSE-S3 is based on the AES-256 encryption algorithm, asymmetric cipher. You cannot access this key or use it manually for any other encryption processing. The key is itself encrypted with a master key that is regularly rotated.

## **Rationale:**

The encryption context is not secret. It appears in plaintext in AWS Cloud trail logs so you can use it to identify and categorize your cryptographic operations. An encryption context can consist of any keys and values. However, because it is not secret and not encrypted, your encryption context should not include sensitive information. We recommend that your encryption context describe the data being encrypted or decrypted. For example, when you encrypt a file, you might use part of the file path as encryption context.

## **Impact:**

Enabling server-side encryption (SSE) on S3 buckets at the object level protects data at rest and helps prevent the breach of sensitive information assets.

## **Default Value:** 

By default, Default encryption is disabled in S3 buckets.

**Pre-Requisite:** 

-   Sign in as an admin or IAM user with the required permissions
    

## **Remediation:**

## **Test Plan:**

-   Log in to the AWS Management Console 
    
-   Go to the S3 console at [https://s3.console.aws.amazon.com/s3](https://s3.console.aws.amazon.com/s3 "https://s3.console.aws.amazon.com/s3")
    
-   In the S3 choose your buckets to examine![](https://support.icompaas.com/assets/kb/4e488d821606bdab.png)
    
-   Go to the properties tab ![](https://support.icompaas.com/assets/kb/96382392d48d9b12.png) 
    
-   Scroll down and go to Default Encryption where it may be enabled or disabled.![](https://support.icompaas.com/assets/kb/37a366fe359cf70f.png)
    

**Using AWS CLI:**

**To retrieve the server-side encryption configuration for a bucket** 

aws s3api get-bucket-encryption 
    --bucket <bucket name>

  

### **Implementation:**

1.  Sign in to the AWS Management Console and open the Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/").
    
2.  In the **Buckets** list, choose the name of the bucket that you want.
    
3.  Choose **Properties**.
    
4.  Under **Default encryption**, choose **Edit**. ![](https://support.icompaas.com/assets/kb/9edece7c658ef6a2.png) 
    
5.  To enable server-side encryption, choose **Enable**. ![](https://support.icompaas.com/assets/kb/6d3cac16aa471871.png) 
    
6.  To enable server-side encryption using an Amazon S3-managed key, under **Encryption key type**, choose ![](https://support.icompaas.com/assets/kb/037d3064a8ce728b.png) 
    
7.  Choose **Save changes**.  
    

  

**Using AWS CLI:**

This example configures default bucket encryption with Amazon S3-managed encryption.

aws s3api put-bucket-encryption --bucket bucket-name --server-side-encryption-configuration '{
    "Rules": \[
        {
            "ApplyServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
            }
        }
    \]
}'

## **Backout Plan:**

-   Log in to the AWS Management Console
    
-   Go to the S3 console at [https://s3.console.aws.amazon.com/s3](https://s3.console.aws.amazon.com/s3 "https://s3.console.aws.amazon.com/s3")
    
-   Select S3 buckets to disable the Default encryption.
    
-   Go to the properties tab
    
-   Scroll down and go to Default Encryption  and click on the Edit button
    
-   Click on disable radio button under server-side encryption and click on the Save button.![](https://support.icompaas.com/assets/kb/afdf0f7fea8e38bc.png)
    

  

**Using AWS CLI:**

**To delete the server-side encryption configuration of a bucket** 

aws s3api delete-bucket-encryption \\
    --bucket <bucket name>

## **Reference:**

[![](https://support.icompaas.com/assets/kb/766660200c0c0010.png)Enabling Amazon S3 default bucket encryption - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html) 

[![](https://support.icompaas.com/assets/kb/b492e452f823115a.png)Securing backup data in Amazon S3 and Amazon Simple Storage Service - AWS Prescriptive Guidance](https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/security.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.