Back to Checks
alibabacloud

Server-side encryption is enabled for OSS buckets

oss_bucket_server_side_encryption_enabled
Service: ossSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:ALIYUN::OSS::Bucket

Alibaba Cloud OSS buckets should define a default server-side encryption rule so every newly uploaded object is encrypted at rest with SSE-OSS (AES256) or SSE-KMS (KMS) without relying on per-request headers.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without a default encryption rule, objects may be stored unencrypted unless every client sets encryption headers. This weakens confidentiality of data at rest and increases the impact of unauthorized bucket access or data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks oss_bucket_server_side_encryption_enabled

Recommendation

Configure a default server-side encryption rule on every OSS bucket (AES256 or KMS) so all new objects are encrypted at rest without depending on client-side headers.

Remediation

CLI

ossutil bucket-encryption --method put oss://<bucket-name> --sse-algorithm AES256

Terraform

resource "alicloud_oss_bucket" "example" {
  bucket = "example-bucket"

  server_side_encryption_rule {
    sse_algorithm = "AES256"
  }
}

Other

1Log on to the **OSS Console**
2In the bucket-list pane, click on a target OSS bucket
3Open **Security** / **Encryption** settings
4Enable default encryption and choose **SSE-OSS (AES256)** or **SSE-KMS**
5Click **Save**

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.oss.oss_client import oss_client


class oss_bucket_server_side_encryption_enabled(Check):
    """Check if default server-side encryption is enabled for OSS buckets."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        """Return PASS/FAIL findings for each OSS bucket's default server-side encryption."""
        findings = []

        for bucket in oss_client.buckets.values():
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=bucket)
            report.region = bucket.region
            report.resource_id = bucket.name
            report.resource_arn = bucket.arn

            algorithm = (bucket.encryption_algorithm or "").upper()
            if algorithm in {"AES256", "KMS"}:
                report.status = "PASS"
                encryption_details = bucket.encryption_algorithm
                if bucket.encryption_kms_key_id:
                    encryption_details += f" (KMS key {bucket.encryption_kms_key_id}"
                    if bucket.encryption_kms_data_algorithm:
                        encryption_details += (
                            f", data encryption {bucket.encryption_kms_data_algorithm}"
                        )
                    encryption_details += ")"
                report.status_extended = f"OSS bucket {bucket.name} has server-side encryption enabled with {encryption_details}."
            else:
                report.status = "FAIL"
                report.status_extended = f"OSS bucket {bucket.name} does not have default server-side encryption enabled."

            findings.append(report)

        return findings

References