If S3 bucket does not have server side encryption enabled, files are unencrypted at rest. This increase likelihood of data and information disclosure to unauthorised parties. When server side encryption is enabled, S3 encrypts an object before saving it to disk and decrypts it when you download the object. As of January 5, 2023, all new object uploads to Amazon S3 are automatically encrypted.

Remediation

resource "aws_kms_key" "mykey" {
  description             = "This key is used to encrypt bucket objects"
  deletion_window_in_days = 10
}

resource "aws_s3_bucket" "mybucket" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
  bucket = aws_s3_bucket.mybucket.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.mykey.arn
      sse_algorithm     = "aws:kms"
    }
  }
}

Reference: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration

Metadata

• Severity: low
• Slug: s3-bucket-unencrypted

OWASP

• A05:2021: Security Misconfiguration