S3 Buckets Should Enforce Server Side Encryption

Using Console

Sure, here are the step-by-step instructions to remediate the S3 Buckets Should Enforce Server Side Encryption misconfiguration in AWS using the AWS console:

Login to your AWS Management Console.
Navigate to the S3 service.
Select the bucket that you want to remediate.
Click on the “Properties” tab.
Under the “Default encryption” section, click on the “Edit” button.
Select “AES-256” or “AWS-KMS” as the encryption type.
Click on the “Save” button.
Repeat the above steps for all the S3 buckets that need to be remediated.

By following the above steps, you can enforce server-side encryption for your S3 buckets in AWS, which will help you remediate the S3 Buckets Should Enforce Server Side Encryption misconfiguration.

Using CLI

To remediate the misconfiguration “S3 Buckets Should Enforce Server Side Encryption” for AWS using AWS CLI, you can follow the below steps:

Open the AWS CLI on your local machine.
Run the following command to list all the S3 buckets in your AWS account:

aws s3 ls

Identify the S3 bucket that needs to be remediated.
Run the following command to enable server-side encryption on the identified bucket:

aws s3api put-bucket-encryption --bucket <bucket-name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'

Note: Replace <bucket-name> with the name of the identified S3 bucket.

Once the command is executed successfully, the identified S3 bucket will enforce server-side encryption.
To verify if the server-side encryption is enabled, run the following command:

aws s3api get-bucket-encryption --bucket <bucket-name>

Note: Replace <bucket-name> with the name of the identified S3 bucket.

If the server-side encryption is enabled, the output of the above command will show the encryption configuration for the S3 bucket.

By following these steps, you can remediate the misconfiguration “S3 Buckets Should Enforce Server Side Encryption” for AWS using AWS CLI.

Using Python

To remediate the misconfiguration in AWS, you can use the AWS SDK for Python (Boto3) to enforce server-side encryption on all S3 buckets. Here are the steps to follow:

Install Boto3 using pip:

pip install boto3

Create a Python script and import the required modules:

import boto3
from botocore.exceptions import ClientError

Instantiate a Boto3 S3 client:

s3 = boto3.client('s3')

Retrieve a list of all S3 buckets:

response = s3.list_buckets()
buckets = [bucket['Name'] for bucket in response['Buckets']]

For each bucket, check if server-side encryption is already enabled:

for bucket in buckets:
    try:
        response = s3.get_bucket_encryption(Bucket=bucket)
        if 'ServerSideEncryptionConfiguration' in response:
            print(f"{bucket} already has server-side encryption enabled.")
        else:
            # Enable server-side encryption
            s3.put_bucket_encryption(
                Bucket=bucket,
                ServerSideEncryptionConfiguration={
                    'Rules': [
                        {
                            'ApplyServerSideEncryptionByDefault': {
                                'SSEAlgorithm': 'AES256'
                            }
                        }
                    ]
                }
            )
            print(f"Server-side encryption enabled for {bucket}.")
    except ClientError as e:
        if e.response['Error']['Code'] == 'ServerSideEncryptionConfigurationNotFoundError':
            # Enable server-side encryption
            s3.put_bucket_encryption(
                Bucket=bucket,
                ServerSideEncryptionConfiguration={
                    'Rules': [
                        {
                            'ApplyServerSideEncryptionByDefault': {
                                'SSEAlgorithm': 'AES256'
                            }
                        }
                    ]
                }
            )
            print(f"Server-side encryption enabled for {bucket}.")
        else:
            print(f"Error checking encryption status for {bucket}: {e}")

Run the script to enable server-side encryption on all S3 buckets.

Note: Before running the script, make sure you have the necessary permissions to modify S3 bucket settings.

Using Terraform

resource "aws_s3_bucket" "this" {
  bucket = "YOUR_BUCKET_NAME" # replace with your bucket name
}

# Option 1: Match CLI example using SSE-S3 (AES256)
resource "aws_s3_bucket_server_side_encryption_configuration" "this_aes256" {
  bucket = aws_s3_bucket.this.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# --- OR ---

# Option 2: Match CLI example using SSE-KMS with your own CMK
# WARNING: This overwrites any existing default encryption configuration for the bucket.
# Ensure the KMS key exists in the same region and IAM principals have kms:Decrypt and kms:GenerateDataKey.
resource "aws_kms_key" "s3_cmk" {
  description             = "KMS key for S3 default encryption"
  deletion_window_in_days = 30
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this_kms" {
  bucket = aws_s3_bucket.this.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.s3_cmk.arn
    }
  }
}

Enabling or changing aws_s3_bucket_server_side_encryption_configuration updates the bucket in place; it does not force bucket replacement, but it will overwrite any existing default encryption configuration.To verify, terraform plan should show either:

+ aws_s3_bucket_server_side_encryption_configuration.this_aes256 with sse_algorithm: "AES256", or
+ aws_s3_bucket_server_side_encryption_configuration.this_kms with sse_algorithm: "aws:kms" and the CMK ARN,
and no - (destroy) for the aws_s3_bucket.this resource.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

S3 Buckets Should Enforce Server Side Encryption

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: