Description

Detects AWS S3 buckets defined in CloudFormation templates that do not have server-side encryption enabled. Server-side encryption is an important security control that protects data at rest in S3 buckets by automatically encrypting data when it is written to the bucket.

Detection Strategy

• Identifies CloudFormation resource blocks of type 'AWS::S3::BucketPolicy'

• Checks if the bucket policy and bucket configuration lack server-side encryption settings

• Reports a vulnerability if either encryption is not configured or if the bucket policy does not enforce encryption

• Specifically looks for missing 'ServerSideEncryptionConfiguration' property in bucket properties

Vulnerable code example

{
  "Resources": {
    "VulnerableBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {...

✅ Secure code example

{
  "Resources": {
    "SecureBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy", 
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {...