Rule: S3 Bucket Default Encryption Should Be Enabled
This rule ensures that default encryption is enabled for S3 buckets, enhancing data security.
| Rule | S3 bucket default encryption should be enabled |
| Framework | NIST 800-53 Revision 5 |
| Severity | ✔ Low |
Default Encryption for S3 Buckets with NIST 800-53 Revision 5
Rule Description
By enabling default encryption for Amazon S3 buckets, you can ensure that all new objects stored within the bucket are automatically encrypted using a specified encryption method. This rule implementation aligns with the security requirements defined in the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5, which provides guidelines and security controls for federal information systems.
Troubleshooting Steps
If default encryption is not enabled for S3 buckets, follow these troubleshooting steps:
- 1.Verify the existing S3 bucket settings by navigating to the Amazon S3 console.
- 2.Select the bucket that needs to be checked for default encryption.
- 3.Click on the "Properties" tab.
- 4.Scroll down to the "Default encryption" section.
- 5.Ensure that default encryption is set to "Enabled".
- 6.If default encryption is disabled or not configured, proceed to the remediation steps.
Necessary Code
No specific code is needed for this rule. The configuration can be achieved through the AWS Management Console or command-line interface (CLI).
Remediation Steps
Follow these steps to enable default encryption for S3 buckets using the AWS Management Console:
- 1.Login to the AWS Management Console.
- 2.Navigate to the Amazon S3 service.
- 3.Select the concerned S3 bucket.
- 4.Click on the "Properties" tab.
- 5.Scroll down to the "Default encryption" section.
- 6.Click on the "Edit" button.
- 7.Select the desired encryption method from the dropdown menu (e.g., SSE-S3, SSE-KMS, or SSE-C).
- 8.Click the "Save changes" button to enable default encryption for the S3 bucket.
If you prefer to use the AWS CLI, follow these steps:
- 1.Open the command-line interface.
- 2.Run the following command to enable default encryption for the S3 bucket using SSE-S3 encryption:
aws s3api put-bucket-encryption --bucket <bucket-name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'
- 1.Replace
with the actual name of the S3 bucket.<bucket-name> - 2.Press Enter to execute the command.
Please note that if you wish to use SSE-KMS or SSE-C encryption, you need to modify the
--server-side-encryption-configurationOnce default encryption is enabled for the S3 bucket, all new objects saved within the bucket will be automatically encrypted with the chosen encryption method specified during configuration.