Description

Detects S3 buckets with policies that explicitly disable server-side encryption requirements. Server-side encryption is a critical security control that protects data at rest in S3 buckets, and disabling it could expose sensitive data to unauthorized access.

Detection Strategy

• Scans all S3 buckets in the AWS account

• Examines each bucket's policy for Condition statements containing 's3:x-amz-server-side-encryption'

• Reports a vulnerability if a policy statement contains a Null condition that sets 's3:x-amz-server-side-encryption' to false

• Each reported vulnerability includes the specific policy statement location and the non-compliant condition value