S3 bucket has default server-side encryption (SSE) enabled

Check ID: s3_bucket_default_encryption
Provider: AWS
Service: s3
Severity: MEDIUM
Categories: encryption
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets have a default server-side encryption setting that automatically encrypts new objects using SSE-S3 or SSE-KMS. This evaluates whether a bucket has a default encryption configuration defined.

Risk

Without default encryption, older objects may remain unencrypted and new uploads won’t be forced to use SSE-KMS. This reduces confidentiality and governance by limiting key audit logs, rotation, and cross-account controls, and increases exposure if data is copied, replicated, or accessed outside intended paths.

Recommendation

Enable default encryption on all buckets, preferring SSE-KMS for sensitive data to retain key control and auditing. Enforce encryption with restrictive bucket policies, apply least privilege to KMS keys with rotation, and re-encrypt existing objects. Use defense in depth monitoring to detect drift and noncompliant uploads.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-bucket-encryption --bucket <bucket_name> --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

resource "aws_s3_bucket" "<example_resource_name>" {
  bucket = "<example_resource_name>"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "<example_resource_name>" {
  bucket = aws_s3_bucket.<example_resource_name>.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"  # Critical: enables default SSE-S3 for the bucket
    }
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256  # Critical: enables default SSE-S3 so new objects are encrypted

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_default_encryption. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket replicates to a bucket in another region S3 bucket has event notifications enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires