[DEPRECATED] S3 bucket has default server-side encryption (SSE) enabled
s3_bucket_default_encryption
[DEPRECATED] Amazon S3 buckets have a default server-side encryption setting that automatically encrypts new objects using SSE-S3 or SSE-KMS. This evaluates whether a bucket has a default encryption configuration defined.
Risk
Without default encryption, older objects may remain unencrypted and new uploads won't be forced to use SSE-KMS. This reduces confidentiality and governance by limiting key audit logs, rotation, and cross-account controls, and increases exposure if data is copied, replicated, or accessed outside intended paths.
prowler aws --checks s3_bucket_default_encryption
Recommendation
Enable default encryption on all buckets, preferring SSE-KMS for sensitive data to retain key control and auditing. Enforce encryption with restrictive bucket policies, apply least privilege to KMS keys with rotation, and re-encrypt existing objects. Use defense in depth monitoring to detect drift and noncompliant uploads.
Remediation
aws s3api put-bucket-encryption --bucket <bucket_name> --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'
- Open the AWS S3 console and select the bucket
- Go to the Properties tab
- In Default encryption, click Edit
- Enable default encryption and select SSE-S3 (AES-256)
- Click Save changes
Source Code
Resource Type
AwsS3Bucket