# Ensure S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it

- Source: https://support.icompaas.com/support/solutions/articles/62000236265-ensure-s3-buckets-have-default-encryption-sse-enabled-or-use-a-bucket-policy-to-enforce-it
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

-   Level 1

  

### **Description:**

This control ensures that all Amazon S3 buckets have default encryption (Server-Side Encryption - SSE) enabled, or alternatively, enforce encryption at upload time via a bucket policy. Enabling default encryption ensures all new objects stored in the bucket are automatically encrypted at rest using SSE-S3 (AES-256), SSE-KMS (AWS Key Management Service), or SSE-C (Customer-provided keys).This helps protect data against unauthorized access, comply with data protection standards, and maintain consistent encryption practices across the organization.

  

### **Rationale:**

Encryption of S3 data at rest is a key control for protecting sensitive information and ensuring compliance with frameworks such as CIS, SOC 2, ISO 27001, HIPAA, and GDPR.  
Without default encryption or an enforcing bucket policy, users could inadvertently upload unencrypted data, resulting in:

-   Data exposure risks.
    
-   Compliance violations.
    
-   Potential data integrity issues.
    

By enabling default encryption or enforcing encryption through a policy, all new data is secured automatically, even if clients do not explicitly request encryption during upload.

  

### **Impact:**

-   Positive Impact:Ensures all stored data is encrypted by default.Simplifies compliance with encryption and data privacy regulations.Reduces risk of human error or application misconfiguration.
-   Negative Impact:Minor increase in KMS API costs if using SSE-KMS.Slight latency increase during encryption/decryption (typically negligible).

  

### **Default Value:**

By default, S3 buckets do not have encryption enabled. Encryption must be manually enabled per bucket or enforced via a bucket policy.

  

### **Pre-Requisite:**

-   IAM permissions required:
    
    -   `s3:GetBucketEncryption`
        
    -   `s3:PutBucketEncryption`
        
    -   `s3:PutBucketPolicy`
        
-   Optional: AWS KMS key (CMK) for SSE-KMS encryption.
    

###   

### **Remediation**

#### **Test Plan**

**Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to Amazon S3 → Buckets.
    
3.  Select the bucket.
    
4.  Under the Properties tab, scroll to Default encryption.
    
5.  Verify that Default encryption is Enabled.
    
6.  Confirm whether the encryption type is SSE-S3 or SSE-KMS.
    
7.  If not enabled, proceed with the implementation plan.
    

###   

### **Implementation Plan**

#### **Using AWS Console:**

1.  Go to Amazon S3 → Buckets → \[Your Bucket\] → Properties.
    
2.  Scroll to Default encryption and click Edit.
    
3.  Enable Default encryption.
    
4.  Choose one of the following encryption methods:
    
    -   SSE-S3 (AES-256) — Amazon-managed keys.
        
    -   SSE-KMS — AWS Key Management Service with a CMK.
        
5.  Click Save changes.
    

####   

### **Backout Plan**

### **Using AWS Console:**

1.  Navigate to Amazon S3 → Buckets → \[Your Bucket\] → Properties.
    
2.  Scroll to Default encryption and click Edit.
    
3.  Disable Default encryption and save changes.
    

  

**References:**

-   [Amazon S3 Default Encryption Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html)
    
-   [AWS CLI Command Reference – put-bucket-encryption](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-encryption.html)
    
-   [AWS KMS Best Practices](https://docs.aws.amazon.com/kms/latest/developerguide/best-practices.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.