Skip to main content

lacework-global-72

2.1.1 Ensure all S3 buckets employ encryption-at-rest (Automated)​

Profile Applicability​

• Level 2

Description​

Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.

Rationale​

Encrypting data at rest reduces the likelihood that it is unintentionally exposed and can nullify the impact of disclosure if the encryption remains unbroken.

Impact​

Amazon S3 buckets with default bucket encryption using SSE-KMS cannot be used as destination buckets for Amazon S3 server access logging. Only SSE-S3 default encryption is supported for server access log destination buckets.

Audit​

From Console​

  1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
  2. Select the Check box next to the Bucket.
  3. Click on 'Properties'.
  4. Verify that Default Encryption displays either AES-256 or AWS-KMS.
  5. Repeat for all the buckets in your AWS account.

From Command Line​

  1. Run command to list buckets
aws s3 ls
  1. For each bucket, run 
aws s3api get-bucket-encryption --bucket <bucket name>
  1. Verify that either 
"SSEAlgorithm": "AES256"

or 

"SSEAlgorithm": "aws:kms"

is displayed.

Remediation​

From Console​

  1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
  2. Select the Check box next to the Bucket.
  3. Click on 'Properties'.
  4. Click on Default Encryption.
  5. Select either AES-256 or AWS-KMS
  6. Click Save
  7. Repeat for all the buckets in your AWS account lacking encryption.

From Command Line​

Run either 

aws s3api put-bucket-encryption --bucket `<bucket name>` --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'

or 

aws s3api put-bucket-encryption --bucket `<bucket name>` --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms","KMSMasterKeyID": "aws/s3"}}]}'
note

the KMSMasterKeyID can be set to the master key of your choosing; aws/s3 is an AWS preconfigured default.

References​

https://docs.aws.amazon.com/AmazonS3/latest/user-guide/default-bucket-encryption.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html#bucket-encryption-related-resources

Additional Information​

S3 bucket encryption only applies to objects as they are placed in the bucket. Enabling S3 bucket encryption does not encrypt objects previously stored within the bucket.