S3 encryption requirement

Enforces server-side encryption for all S3 uploads, ensuring all data is encrypted at rest for compliance and security.

Policy description

What this SCP does

This Service Control Policy (SCP) enforces server-side encryption for all S3 uploads, ensuring all data is encrypted at rest. This is important for compliance requirements and data protection.

When users try to upload objects to S3 without specifying encryption, the operation will be denied. This ensures that all data stored in S3 across the organization is encrypted, helping to meet security and compliance requirements.

Validation strategy

How to test this SCP works

To validate this SCP, try to upload objects to S3 with and without encryption.

Invalid test: Upload a file to S3 without specifying encryption (should be denied)
Valid test: Upload a file to S3 with server-side encryption (should succeed)

We expect uploads without encryption to be denied with an AccessDenied error, while uploads that specify server-side encryption should succeed.

SCP policy & validation scenarios

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyUnencryptedS3Uploads", "Effect": "Deny", "Action": "s3:PutObject", "Resource": "*", "Condition": { "Null": { "s3:x-amz-server-side-encryption": "true" } } } ] }

# Create a test bucket aws s3 mb s3://test-scp-encryption-bucket # Try to upload a file without encryption (this should be denied) echo "Test content" > test-file.txt aws s3 cp test-file.txt s3://test-scp-encryption-bucket/unencrypted.txt # Try to upload a file with server-side encryption (this should succeed) aws s3 cp test-file.txt s3://test-scp-encryption-bucket/encrypted.txt --sse AES256 # Clean up aws s3 rb s3://test-scp-encryption-bucket --force

import boto3 import time # Initialize S3 client s3_client = boto3.client('s3') # Create a test bucket try: bucket_name = f"test-scp-encryption-bucket-{int(time.time())}" s3_client.create_bucket(Bucket=bucket_name) print(f"Created test bucket: {bucket_name}") # Try to upload an object without encryption try: s3_client.put_object( Bucket=bucket_name, Key='unencrypted.txt', Body='This is test content without encryption' ) print("WARNING: Successfully uploaded object without encryption - SCP is NOT restricting as expected") except Exception as e: print(f"Expected error for upload without encryption if SCP is working: {e}") # Try to upload an object with encryption try: s3_client.put_object( Bucket=bucket_name, Key='encrypted.txt', Body='This is test content with encryption', ServerSideEncryption='AES256' ) print("Successfully uploaded object with encryption") except Exception as e: print(f"Unexpected error for upload with encryption: {e}") # Clean up try: objects = s3_client.list_objects_v2(Bucket=bucket_name) if 'Contents' in objects: for obj in objects['Contents']: s3_client.delete_object(Bucket=bucket_name, Key=obj['Key']) s3_client.delete_bucket(Bucket=bucket_name) print(f"Cleaned up test bucket: {bucket_name}") except Exception as e: print(f"Error during cleanup: {e}") except Exception as e: print(f"Error creating test bucket: {e}")