Rule: S3 Bucket Default Encryption Should Be Enabled with KMS

Rule Description

Troubleshooting Steps

2. 1.
   Check bucket encryption settings: Verify if default encryption is enabled for the S3 bucket.
4. 2.
   Check encryption configuration: Ensure that the encryption configuration is set to use AWS Key Management Service (KMS).
6. 3.
   Verify KMS key usage policy: Validate that the KMS key associated with the bucket has the necessary key usage policy to meet NIST 800-53 Revision 5 compliance.
8. 4.
   Check KMS key configuration: Ensure that the KMS key is properly configured and is not expired or disabled.
10. 5.
    Verify IAM roles and policies: Ensure that the IAM roles and policies associated with the bucket have the necessary permissions to access and use the KMS key.

Necessary Codes

aws s3api get-bucket-encryption --bucket <bucket_name>

aws s3api put-bucket-encryption --bucket <bucket_name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms", "KMSMasterKeyID":"<kms_key_id>"}}]}'

<bucket_name>

<kms_key_id>

Step-by-Step Guide for Remediation

2. 1.

   Verify current encryption settings:

   • Run the following AWS CLI command to check if default encryption is already enabled for the bucket:

   aws s3api get-bucket-encryption --bucket <bucket_name>
   

   • If default encryption is already enabled and configured with KMS, proceed to the next step. Otherwise, continue with the next steps for remediation.
4. 2.

   Create or identify a KMS key:

   • If you don't have a KMS key, create one using the AWS Management Console or AWS CLI. Make sure the KMS key has the desired configuration and meets the NIST 800-53 Revision 5 compliance requirements.
   • Note down the KMS key ID for later use.
6. 3.

   Enable default encryption with KMS:

   • Run the following AWS CLI command to enable default encryption using KMS for the S3 bucket:

   aws s3api put-bucket-encryption --bucket <bucket_name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms", "KMSMasterKeyID":"<kms_key_id>"}}]}'
   

   • Replace

     <bucket_name>

     with the name of the S3 bucket you want to enable default encryption for.
   • Replace

     <kms_key_id>

     with the ID of the KMS key you want to use for encryption.
8. 4.

   Verify the encryption configuration:

   • Run the following AWS CLI command to verify the encryption configuration of the S3 bucket:

   aws s3api get-bucket-encryption --bucket <bucket_name>
   

   • Ensure that the response shows the desired encryption configuration with the specified KMS key.