AWS S3 Object encryption with SSE-C
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detects attempts to encrypt AWS S3 objects using server-side encryption with customer-provided keys (SSE-C).
Strategy
This rule monitors CloudTrail logs for S3 object operations (CopyObject and PutObject) where customer-provided encryption keys are used. When external encryption is applied to S3 objects, the rule detects this by examining the @requestParameters.x-amz-server-side-encryption-customer-algorithm attribute. This activity warrants attention since attackers can leverage SSE-C encryption with their own keys to make objects inaccessible to legitimate owners, essentially enabling ransomware-style attacks.
Triage & Response
- Verify if the detected activity aligns with approved change management processes or expected administrative actions.
- Examine the actor
{{@userIdentity.arn}} and {{@userIdentity.accessKeyId}} to determine if they are authorized to perform encryption operations on the affected S3 buckets. - Check if the affected S3 bucket
{{@requestParameters.bucketName}} contains sensitive or critical data that would be valuable for ransomware targets. - Revoke the access key
{{@userIdentity.accessKeyId}} if determined to be unauthorized or compromised. - Restore affected objects from backups if available and confirmed encrypted without authorization.
- Implement S3 bucket policies to restrict the use of SSE-C encryption to approved roles and service accounts only.
