This rule is deprecated, and will eventually be removed.
Server-side encryption (SSE) encrypts an object (not the metadata) as it is written to disk (where the S3 bucket resides) and decrypts it as it is
read from disk. This doesn’t change the way the objects are accessed, as long as the user has the necessary permissions, objects are retrieved as if
they were unencrypted. Thus, SSE only helps in the event of disk thefts, improper disposals of disks and other attacks on the AWS infrastructure
itself.
There are three SSE options:
- Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
- AWS manages encryption keys and the encryption itself (with AES-256) on its own.
- Server-Side Encryption with Customer Master Keys (CMKs) Stored in AWS Key Management Service (SSE-KMS)
- AWS manages the encryption (AES-256) of objects and encryption keys provided by the AWS KMS service.
- Server-Side Encryption with Customer-Provided Keys (SSE-C)
- AWS manages only the encryption (AES-256) of objects with encryption keys provided by the customer. AWS doesn’t store the customer’s
encryption keys.
Ask Yourself Whether
- The S3 bucket stores sensitive information.
- The infrastructure needs to comply to some regulations, like HIPAA or PCI DSS, and other standards.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
It’s recommended to use SSE. Choosing the appropriate option depends on the level of control required for the management of encryption keys.
Sensitive Code Example
Server-side encryption is not used:
bucket = s3.Bucket(self,"bucket",
encryption=s3.BucketEncryption.UNENCRYPTED # Sensitive
)
The default value of encryption is KMS if encryptionKey is set. Otherwise, if both parameters are absent the
bucket is unencrypted.
Compliant Solution
Server-side encryption with Amazon S3-Managed Keys is used:
bucket = s3.Bucket(self,"bucket",
encryption=s3.BucketEncryption.S3_MANAGED
)
# Alternatively with a KMS key managed by the user.
bucket = s3.Bucket(self,"bucket",
encryptionKey=access_key
)
See
