​
More Info:

S3 buckets should have default encryption (SSE) enabled or use a bucket policy to enforce it. S3 default encryption will enable Amazon to encrypt your S3 data at the bucket level instead of object level in order to protect it from attackers or unauthorized personnel.

​
Risk Level

High

​
Address

Security

​
Compliance Standards

HIPAA, GDPR, CISAWS, CBP, NIST, AWSWAF, SOC2, NISTCSF, PCIDSS

​
Triage and Remediation

​
Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of S3 Buckets not having default encryption enabled in AWS:
  1. Log in to the AWS Management Console.
  2. Go to the S3 service dashboard.
  3. Click on the bucket for which you want to enable default encryption.
  4. Click on the “Properties” tab.
  5. Scroll down to the “Default encryption” section and click on “Edit”.
  6. Select “AES-256” or “AWS-KMS” as the default encryption option.
  7. If you choose “AWS-KMS”, select the KMS key that you want to use for encryption.
  8. Click on the “Save” button to save the changes.
After following these steps, the S3 bucket will have default encryption enabled, and all objects stored in the bucket will be encrypted with the selected encryption option.

​

To remediate the misconfiguration of S3 Buckets not having default encryption enabled in AWS, you can follow the below steps using AWS CLI:
  1. Open the AWS CLI on your system.
  2. Check if the S3 bucket has default encryption enabled or not using the following command: 
    aws s3api get-bucket-encryption --bucket <bucket-name>
  3. If the response shows that default encryption is not enabled, then you can enable it using the following command: 
    aws s3api put-bucket-encryption --bucket <bucket-name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'
    This command will enable default encryption for the specified S3 bucket using AES256 encryption.
  4. Verify that default encryption is enabled on the S3 bucket using the following command: 
    aws s3api get-bucket-encryption --bucket <bucket-name>
    The response should show that default encryption is enabled on the S3 bucket.
By following the above steps, you can remediate the misconfiguration of S3 Buckets not having default encryption enabled in AWS using AWS CLI.
To remediate the misconfiguration of S3 buckets not having default encryption enabled in AWS using Python, you can follow these steps:
  1. Install the AWS SDK for Python (Boto3) using pip:
pip install boto3
  1. Configure AWS credentials using the AWS CLI or by setting environment variables.
  2. Write a Python script to enable default encryption for all S3 buckets in your AWS account: 
import boto3

# Create an S3 client
s3 = boto3.client('s3')

# Get a list of all S3 buckets in your account
buckets = s3.list_buckets()['Buckets']

# For each bucket, check if default encryption is enabled
for bucket in buckets:
    bucket_name = bucket['Name']
    bucket_encryption = s3.get_bucket_encryption(Bucket=bucket_name)
    
    # If default encryption is not enabled, enable it
    if 'ServerSideEncryptionConfiguration' not in bucket_encryption:
        s3.put_bucket_encryption(
            Bucket=bucket_name,
            ServerSideEncryptionConfiguration={
                'Rules': [
                    {
                        'ApplyServerSideEncryptionByDefault': {
                            'SSEAlgorithm': 'AES256'
                        }
                    }
                ]
            }
        )
  1. Run the Python script to enable default encryption for all S3 buckets in your AWS account.
Note: This script will enable default encryption using AES256 algorithm. If you want to use a different encryption algorithm, you can modify the script accordingly.

​
Additional Reading: