Other Articles

S3 Bucket – Enable S3 Bucket Encryption

Secure Configuration Checks > AWS

This check ensures that server-side encryption is enabled for Amazon S3 buckets. Encryption protects data at rest by automatically encrypting objects stored in the bucket using AWS-managed or customer-managed keys.

Check Details

  • Resource: S3 Bucket
  • Check: Enable S3 bucket encryption
  • Risk: Unencrypted data may be exposed if accessed without authorization

Remediation via AWS Console

  1. Log in to the AWS Management Console and open the Amazon S3 console.

    Amazon S3 Console
  2. Select the S3 bucket where encryption is not enabled.

  3. Open the Properties tab.

    S3 properties tab
  4. Under Default encryption, click Edit and enable Server-side encryption.

  5. Choose an encryption option:

    • SSE-S3 (Amazon S3–managed keys)
    • SSE-KMS (AWS KMS–managed keys)
    Enable S3 encryption
  6. Click Save changes.

Remediation via AWS CLI

  1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.

    AWS CloudShell

  2. Enable default encryption using SSE-S3:

    aws s3api put-bucket-encryption \
--bucket <bucket-name> \
--server-side-encryption-configuration '{
"Rules": [
{
"ApplyServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
}'

Updated on 06 March, 2026