lacework-global-72
Ensure all S3 buckets employ encryption-at-rest (Automated)
Profile Applicability
• Level 2
Description
Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.
Rationale
Encrypting data at rest reduces the likelihood that it is unintentionally exposed and can nullify the impact of disclosure if the encryption remains unbroken.
Impact
Amazon S3 buckets with default bucket encryption using SSE-KMS cannot be used as destination buckets for Amazon S3 server access logging. Only SSE-S3 default encryption is supported for server access log destination buckets.
Audit
From Console
- Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
- Select the Check box next to the Bucket.
- Click on 'Properties'.
- Verify that
Default Encryption
displays eitherAES-256
orAWS-KMS
. - Repeat for all the buckets in your AWS account.
From Command Line
- Run command to list buckets
aws s3 ls
- For each bucket, run
aws s3api get-bucket-encryption --bucket <bucket name>
- Verify that either
"SSEAlgorithm": "AES256"
or
"SSEAlgorithm": "aws:kms"
is displayed.
Remediation
From Console
- Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/.
- Select the Check box next to the Bucket.
- Click
Properties
. - Click
Default Encryption
. - Select either
AES-256
orAWS-KMS
. - Click
Save
. - Repeat for all the buckets in your AWS account lacking encryption.
From Command Line
Run either
aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'
or
aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms","KMSMasterKeyID": "aws/s3"}}]}'
Set the KMSMasterKeyID to the master key of your choosing; aws/s3 is an AWS preconfigured default.
References
https://docs.aws.amazon.com/AmazonS3/latest/user-guide/default-bucket-encryption.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html#bucket-encryption-related-resources
Additional Information
S3 bucket encryption only applies to new objects placed in the bucket. Enabling S3 bucket encryption does not encrypt objects previously stored within the bucket.