S3 Bucket Without Server-side-encryption
- Query id: b2e8752c-3497-4255-98d2-e4ae5b46bbf5
- Query name: S3 Bucket Without Server-side-encryption
- Platform: CloudFormation
- Severity: High
- Category: Encryption
- CWE: 311
- URL: Github
Description¶
S3 Buckets should have server-side encryption at rest enabled to protect sensitive data
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - yaml file
#this is a problematic code where the query should report a result(s)
AWSTemplateFormatVersion: '2010-09-09'
Description: S3 bucket without default encryption
Resources:
S3Bucket:
Type: 'AWS::S3::Bucket'
Properties:
BucketName:
'Fn::Sub': 'bucket-${AWS::Region}-${AWS::AccountId}'
DeletionPolicy: Delete
Positive test num. 2 - json file
{
"Resources": {
"S3Bucket": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketName": {
"Fn::Sub": "bucket-${AWS::Region}-${AWS::AccountId}"
}
},
"DeletionPolicy": "Delete"
}
},
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "S3 bucket without default encryption"
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
#this code is a correct code for which the query should not find any result
AWSTemplateFormatVersion: '2010-09-09'
Description: S3 bucket with default encryption
Resources:
EncryptedS3Bucket:
Type: 'AWS::S3::Bucket'
Properties:
BucketName:
'Fn::Sub': 'encryptedbucket-${AWS::Region}-${AWS::AccountId}'
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: 'aws:kms'
KMSMasterKeyID: KMS-KEY-ARN
DeletionPolicy: Delete
Negative test num. 2 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "S3 bucket with default encryption",
"Resources": {
"EncryptedS3Bucket": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketName": {
"Fn::Sub": "encryptedbucket-${AWS::Region}-${AWS::AccountId}"
},
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"SSEAlgorithm": "aws:kms",
"KMSMasterKeyID": "KMS-KEY-ARN"
}
}
]
}
},
"DeletionPolicy": "Delete"
}
}
}