Description

Ensure that Amazon S3 buckets have default server-side encryption configured using AWS KMS (SSE-KMS), rather than relying solely on Amazon S3-managed keys (SSE-S3), so that objects uploaded to the bucket are automatically encrypted with a key the organization can control and audit.

Rationale

While S3 now encrypts all objects by default using SSE-S3, this default does not provide the organization with control over the encryption key's rotation, access policy, or the ability to audit key usage through CloudTrail with the same granularity as a KMS key. Configuring default bucket encryption with SSE-KMS, and optionally a customer-managed key, ensures newly uploaded objects are automatically encrypted with a key that provides stronger access control and auditability.

Impact

  • Provides organizational control over the encryption key protecting bucket objects

  • Enables detailed key usage auditing via CloudTrail for object access

  • Introduces a per-request cost for KMS encrypt/decrypt calls and requires the relevant principals to have appropriate KMS key permissions

Default Value

S3 buckets are encrypted using Amazon S3-managed keys (SSE-S3) by default; SSE-KMS must be explicitly configured as the bucket's default encryption setting.

Pre-Requisites

  • An AWS KMS key with a key policy granting the relevant application and administrative principals the required permissions

  • IAM permissions to update bucket encryption configuration (s3:PutEncryptionConfiguration)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon S3 > Buckets and select the bucket to review.

  3. Open the Properties tab.

  4. Review the Default encryption section.

  5. Verify that Encryption type shows as Server-side encryption with AWS Key Management Service keys (SSE-KMS), with the appropriate key referenced.

  6. If the bucket uses SSE-S3 (Amazon S3-managed keys) instead, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS KMS and create (or identify) a customer-managed key with a key policy granting the required application and administrative principals the necessary permissions.

  3. Navigate to Amazon S3 > Buckets and select the bucket to update.

  4. Open the Properties tab and select Edit next to Default encryption.

  5. Select Server-side encryption with AWS Key Management Service keys (SSE-KMS) and choose the KMS key created above.

  6. Save the changes and verify newly uploaded objects are encrypted with the selected KMS key (existing objects are not automatically re-encrypted and may require a separate remediation, such as an S3 Batch Operations copy job).

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon S3 > Buckets and select the affected bucket.

  3. Open the Properties tab and select Edit next to Default encryption.

  4. Select Server-side encryption with Amazon S3 managed keys (SSE-S3), if reverting is required.

  5. Save the changes.

Reference