# Ensure S3 Bucket Has Server-Side Encryption with AWS KMS

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890046649781-ensure-s3-bucket-has-server-side-encryption-with-aws-kms
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon S3 buckets have default server-side encryption configured using AWS KMS (SSE-KMS), rather than relying solely on Amazon S3-managed keys (SSE-S3), so that objects uploaded to the bucket are automatically encrypted with a key the organization can control and audit.

**Rationale**

While S3 now encrypts all objects by default using SSE-S3, this default does not provide the organization with control over the encryption key's rotation, access policy, or the ability to audit key usage through CloudTrail with the same granularity as a KMS key. Configuring default bucket encryption with SSE-KMS, and optionally a customer-managed key, ensures newly uploaded objects are automatically encrypted with a key that provides stronger access control and auditability.

**Impact**

-   Provides organizational control over the encryption key protecting bucket objects
    
-   Enables detailed key usage auditing via CloudTrail for object access
    
-   Introduces a per-request cost for KMS encrypt/decrypt calls and requires the relevant principals to have appropriate KMS key permissions
    

**Default Value**

S3 buckets are encrypted using Amazon S3-managed keys (SSE-S3) by default; SSE-KMS must be explicitly configured as the bucket's default encryption setting.

**Pre-Requisites**

-   An AWS KMS key with a key policy granting the relevant application and administrative principals the required permissions
    
-   IAM permissions to update bucket encryption configuration (s3:PutEncryptionConfiguration)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon S3 > Buckets and select the bucket to review.
    
3.  Open the Properties tab.
    
4.  Review the Default encryption section.
    
5.  Verify that Encryption type shows as Server-side encryption with AWS Key Management Service keys (SSE-KMS), with the appropriate key referenced.
    
6.  If the bucket uses SSE-S3 (Amazon S3-managed keys) instead, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS KMS and create (or identify) a customer-managed key with a key policy granting the required application and administrative principals the necessary permissions.
    
3.  Navigate to Amazon S3 > Buckets and select the bucket to update.
    
4.  Open the Properties tab and select Edit next to Default encryption.
    
5.  Select Server-side encryption with AWS Key Management Service keys (SSE-KMS) and choose the KMS key created above.
    
6.  Save the changes and verify newly uploaded objects are encrypted with the selected KMS key (existing objects are not automatically re-encrypted and may require a separate remediation, such as an S3 Batch Operations copy job).
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon S3 > Buckets and select the affected bucket.
    
3.  Open the Properties tab and select Edit next to Default encryption.
    
4.  Select Server-side encryption with Amazon S3 managed keys (SSE-S3), if reverting is required.
    
5.  Save the changes.
    

**Reference**

-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.