Back to Checks
aws

[DEPRECATED] S3 bucket has default server-side encryption (SSE) enabled

s3_bucket_default_encryption
Service: s3Severity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsS3Bucket

[DEPRECATED] Amazon S3 buckets have a default server-side encryption setting that automatically encrypts new objects using SSE-S3 or SSE-KMS. This evaluates whether a bucket has a default encryption configuration defined.

Prowler logoProwlerprowler-provider-aws

Risk

Without default encryption, older objects may remain unencrypted and new uploads won't be forced to use SSE-KMS. This reduces confidentiality and governance by limiting key audit logs, rotation, and cross-account controls, and increases exposure if data is copied, replicated, or accessed outside intended paths.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_bucket_default_encryption

Recommendation

Enable default encryption on all buckets, preferring SSE-KMS for sensitive data to retain key control and auditing. Enforce encryption with restrictive bucket policies, apply least privilege to KMS keys with rotation, and re-encrypt existing objects. Use defense in depth monitoring to detect drift and noncompliant uploads.

Remediation

CLI

aws s3api put-bucket-encryption --bucket <bucket_name> --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

Terraform

resource "aws_s3_bucket" "<example_resource_name>" {
  bucket = "<example_resource_name>"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "<example_resource_name>" {
  bucket = aws_s3_bucket.<example_resource_name>.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"  # Critical: enables default SSE-S3 for the bucket
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256  # Critical: enables default SSE-S3 so new objects are encrypted

Other

1Open the AWS S3 console and select the bucket
2Go to the Properties tab
3In Default encryption, click Edit
4Enable default encryption and select SSE-S3 (AES-256)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client


class s3_bucket_default_encryption(Check):
    def execute(self):
        findings = []
        for bucket in s3_client.buckets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
            if bucket.encryption:
                report.status = "PASS"
                report.status_extended = f"S3 Bucket {bucket.name} has Server Side Encryption with {bucket.encryption}."
            else:
                report.status = "FAIL"
                report.status_extended = f"S3 Bucket {bucket.name} does not have Server Side Encryption enabled."
            findings.append(report)
        return findings

References