logo

Database

Json Yaml Server Side Encryption Disabled

Description

Detects AWS S3 buckets defined in CloudFormation templates that do not have server-side encryption enabled. Server-side encryption is an important security control that protects data at rest in S3 buckets by automatically encrypting data when it is written to the bucket.

Weakness:

099 - Non-encrypted confidential information - S3 Server Side Encryption

Category: Information Collection

Detection Strategy

    • Identifies CloudFormation resource blocks of type 'AWS::S3::BucketPolicy'

    • Checks if the bucket policy and bucket configuration lack server-side encryption settings

    • Reports a vulnerability if either encryption is not configured or if the bucket policy does not enforce encryption

    • Specifically looks for missing 'ServerSideEncryptionConfiguration' property in bucket properties

Vulnerable code example

{
  "Resources": {
    "VulnerableBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {...

✅ Secure code example

{
  "Resources": {
    "SecureBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy", 
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {...