Default encryption should be enabled on S3 buckets

s3
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Amazon S3 provides a variety of no-cost or low-cost encryption options to protect data at rest.

Rationale

Encrypting data at rest reduces the likelihood that it is unintentionally exposed and can nullify the impact of disclosure if the encryption remains unbroken.

Remediation

From the console

  1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
  2. Select the Check box next to the Bucket.
  3. Click on Properties.
  4. Click on Default Encryption.
  5. Select either AES-256 or AWS-KMS.
  6. Click Save.
  7. Repeat for all the buckets in your AWS account lacking encryption.

From the command line

Run one of the following commands:

aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration ''{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}''

or:

aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration ''{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms","KMSMasterKeyID": "aws/s3"}}]}''

Note: The KMSMasterKeyID can be set to the master key of your choosing; aws/s3 is an AWS preconfigured default.

References

  1. https://docs.aws.amazon.com/AmazonS3/latest/user-guide/default-bucket-encryption.html
  2. https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html#bucket-encryption-related-resources

Additional Information: S3 bucket encryption only applies to objects as they are placed in the bucket. Enabling S3 bucket encryption does not encrypt objects previously stored within the bucket.