S3 bucket policy enforcement

Requires all S3 bucket uploads to include server-side encryption, ensuring data at rest is always protected.

Policy description

What this SCP does

This Service Control Policy (SCP) requires all S3 bucket uploads to include server-side encryption, ensuring data at rest is always protected. This is a critical security control for data protection.

By enforcing encryption for all object uploads, this policy ensures that all data stored in S3 is encrypted at rest, helping to meet compliance requirements and protect sensitive information from unauthorized access in the event of a breach.

Validation strategy

How to test this SCP works

To validate this SCP, try to upload objects to S3 with and without encryption.

Invalid test: Upload a file to S3 without specifying encryption (should be denied)
Valid test: Upload a file to S3 with server-side encryption enabled (should succeed)

We expect uploads without encryption to be denied with an AccessDenied error, while uploads with proper server-side encryption specified should succeed. This confirms that the SCP is enforcing the encryption requirement for all object uploads.

SCP policy & validation scenarios

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyUnencryptedS3Uploads", "Effect": "Deny", "Action": "s3:PutObject", "Resource": "*", "Condition": { "Null": { "s3:x-amz-server-side-encryption": "true" } } } ] }

# Create a test bucket aws s3 mb s3://test-scp-encryption-bucket-$(date +%s) # Try to upload a file without encryption (this should be denied) echo "Test content" > test-file.txt aws s3 cp test-file.txt s3://test-scp-encryption-bucket-123/unencrypted.txt # Try to upload a file with server-side encryption (this should succeed) aws s3 cp test-file.txt s3://test-scp-encryption-bucket-123/encrypted.txt \ --server-side-encryption AES256 # Clean up aws s3 rb s3://test-scp-encryption-bucket-123 --force

import boto3 import time # Initialize S3 client s3_client = boto3.client('s3') # Create a test bucket try: bucket_name = f"test-scp-encryption-bucket-{int(time.time())}" s3_client.create_bucket(Bucket=bucket_name) print(f"Created test bucket: {bucket_name}") # Try to upload an object without encryption try: s3_client.put_object( Bucket=bucket_name, Key='unencrypted.txt', Body='This is test content without encryption' ) print("WARNING: Successfully uploaded object without encryption - SCP is NOT restricting as expected") except Exception as e: print(f"Expected error for upload without encryption if SCP is working: {e}") # Try to upload an object with encryption try: s3_client.put_object( Bucket=bucket_name, Key='encrypted.txt', Body='This is test content with encryption', ServerSideEncryption='AES256' ) print("Successfully uploaded object with encryption") except Exception as e: print(f"Unexpected error for upload with encryption: {e}") # Clean up try: objects = s3_client.list_objects_v2(Bucket=bucket_name) if 'Contents' in objects: for obj in objects['Contents']: s3_client.delete_object(Bucket=bucket_name, Key=obj['Key']) s3_client.delete_bucket(Bucket=bucket_name) print(f"Cleaned up test bucket: {bucket_name}") except Exception as e: print(f"Error during cleanup: {e}") except Exception as e: print(f"Error creating test bucket: {e}")