Need

Enforcement of Server-Side Encryption for all S3 buckets

Context

• Usage of AWS CloudFormation for Infrastructure as Code (IaC)
• Ensuring data security in Amazon S3 buckets

Description

Non compliant code

        Resources:
  InsecureS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-bucket
      AccessControl: Private
      Tags:
        - Key: Name
          Value: MyBucket
        - Key: Environment
          Value: Dev

        
        

In this CloudFormation template, an S3 bucket is created with the AccessControl set to Private, restricting public access. However, there is no configuration for BucketEncryption, meaning that Server-Side Encryption (SSE) is not enabled.

Without SSE, data stored in the S3 bucket remains unencrypted at rest, making it vulnerable to unauthorized access and data breaches. If an attacker gains access to the S3 bucket, they could retrieve unencrypted data.

To mitigate this risk, Server-Side Encryption should be enabled by adding the BucketEncryption property and specifying the SSEAlgorithm as "AES256" or "aws:kms".

Steps

• Modify the CloudFormation template to include the `BucketEncryption` property.
• Set the `ServerSideEncryptionByDefault` block to specify an encryption method.
• Choose the appropriate server-side encryption method, such as SSE-S3 (`AES256`) or SSE-KMS (`aws:kms`), based on security requirements.
• Deploy the updated CloudFormation template to enforce encryption for all objects stored in the S3 bucket.

Compliant code

        Resources:
  SecureS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-bucket
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      Tags:
        - Key: Name
          Value: MyBucket
        - Key: Environment
          Value: Dev

        
        

This revised CloudFormation template includes the BucketEncryption property to enforce Server-Side Encryption (SSE).

The ServerSideEncryptionConfiguration block defines a rule that applies encryption by default using the AES256 algorithm. This ensures that all objects stored in the bucket are encrypted at rest.

The Tags property remains unchanged, as it is used to assign metadata to the S3 bucket.

Applying this updated configuration will enforce encryption for all new objects stored in the bucket, enhancing data security and compliance.

References

• 099. Non-encrypted confidential information - S3 Server Side Encryption