Ensure S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.