S3 bucket has server-side encryption with AWS KMS

Check ID: s3_bucket_kms_encryption
Provider: AWS
Service: s3
Severity: MEDIUM
Categories: encryption
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets use server-side encryption with AWS KMS keys, including dual-layer aws:kms:dsse. The evaluation identifies buckets whose default encryption is aws:kms or aws:kms:dsse rather than SSE-S3.

Risk

Without KMS-based encryption, data relies only on SSE-S3, reducing confidentiality controls. Missing key policies and grants weakens least privilege, cross-account scoping, and the ability to disable or rotate keys. Lack of KMS audit trails obscures key usage, hindering detection of misuse and defense in depth.

Recommendation

Enable default SSE-KMS (or DSSE-KMS for highly sensitive data). Use a customer-managed key, enforce least privilege and separation of duties for key usage, and require KMS encryption via bucket policy (specify aws:kms and a designated key). Monitor key activity in CloudTrail and consider S3 Bucket Keys to control cost.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-bucket-encryption --bucket <BUCKET_NAME> --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"}}]}'

# Enable default SSE-KMS on an existing S3 bucket
resource "aws_s3_bucket_server_side_encryption_configuration" "<example_resource_name>" {
  bucket = "<example_bucket_name>"

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms" # Critical: enforces SSE-KMS by default
    }
  }
}

# CloudFormation: enable default SSE-KMS on the bucket
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms  # Critical: sets default encryption to AWS KMS (SSE-KMS)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_kms_encryption. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket has event notifications enabled S3 bucket has Block Public Access enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires