/
/

How to Operate Amazon S3 Server-Side Encryption With Guardrails

by Ann Conte, IT Technical Writer
How to Operate Amazon S3 Server-Side Encryption With Guardrails blog banner image

Instant Summary

This NinjaOne blog post offers a comprehensive basic CMD commands list and deep dive into Windows commands with over 70 essential cmd commands for both beginners and advanced users. It explains practical command prompt commands for file management, directory navigation, network troubleshooting, disk operations, and automation with real examples to improve productivity. Whether you’re learning foundational cmd commands or mastering advanced Windows CLI tools, this guide helps you use the Command Prompt more effectively.

Key Points

  • Classify Buckets and Choose S3 SSE Mode: Classify tenant data and choose S3 SSE mode for SSE-S3 simplicity, SSE-KMS key control, SSE-C customer-managed keys.
  • Turn on Default Encryption, Enforce Deny Policies: Enable bucket default encryption and add deny policies that block PutObject requests without valid encryption headers.
  • Apply Strict Key Policies and Enable Rotation: For SSE-KMS, use least-privilege key policies, separate admins/users, restrict IAM roles/services, and enable annual rotation.
  • Require TLS (HTTPS) for All S3 Access: Enforce encrypted transport by attaching a bucket policy that denies non-TLS (HTTP) requests.
  • Verify Encryption Coverage with S3 Inventory and Logs: Verify coverage using S3 Inventory EncryptionStatus; compute encrypted-object percentage and flag exceptions.
  • Maintain Evidence and Continuous Reporting for Compliance: Produce monthly evidence packets summarizing encryption coverage, denied unencrypted requests, key usage, and policy updates.

AWS S3 server-side encryption protects data at rest, but it really shines as a data security tool when encryption is applied by default, enforced by policy, governed with clear key ownership, and verified with evidence. Take advantage of all the tools at your disposal to ensure that the organization’s data is protected.

A guide for activating AWS S3 default encryption

📌 Prerequisites:

  • You need to have done an inventory of buckets by tenant and data class.
  • You need decision criteria for SSE-S3 versus SSE-KMS per bucket.
  • You need a KMS key policy template with owner and user roles defined.
  • You need destination buckets for S3 Inventory and server access logs.
  • You need an evidence workspace for policy diffs, CSVs, and monthly packets

Step 1: Decide on the SSE mode per bucket

Server-side encryption is an encryption type where data is encrypted by the service or application that receives it. Amazon offers this service by default using Amazon S3 managed keys (SSE-S3). However, you can change or upgrade this according to your own needs. Here are the options available:

  • SSE-S3:The default option. The encryption keys are managed by Amazon S3.
  • SSE-KMS: The encryption keys are stored and managed in AWS Key Management Service (KMS).
  • SSE-C: The customer will provide their own encryption keys for each write request. AWS performs AES-256 encryption using the provided key but does not store or manage the keys. Customers are responsible for key management and availability for decryption operations.

You can choose a different SSE mode per bucket. Keep track of which method you use for which bucket.

Step 2: Enable bucket default encryption

Once you’ve decided on which encryption method you want for a bucket, it’s time to put it to use. Turn on default encryption for every bucket so that new objects are encrypted automatically. This way, you can ensure that your data is kept secure.

Save a short CLI output or screenshots to your evidence workspace per bucket. This encourages transparency and accountability.

Step 3: Deny unencrypted object uploads with policy

Attach a bucket policy that blocks PutObject without required encryption headers or with disallowed algorithms. To do that, you should:

  1. Go to Amazon S3 > Buckets.
  2. Select the target bucket that stores sensitive or regulated data.
  3. Note the bucket’s ARN (Amazon Resource Name) since you’ll need this to create the bucket policy.
  4. Create a JSON file in a separate program that denies any PutObject operation without the proper encryption headers. Here’s a sample you can use as a reference:
{
"Version": "2012-10-17",
"Id": "EnforceS3EncryptionPolicy",
"Statement": [
{
"Sid": "DenyUnEncryptedObjectUploads",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::your-bucket-name/*",
"Condition": {
"StringNotEqualsIfExists": {
"s3:x-amz-server-side-encryption": ["AES256", "aws:kms"]
}
}
},
{
"Sid": "DenyInsecureTransport",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::your-bucket-name",
"arn:aws:s3:::your-bucket-name/*"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
  1. Once done with the JSON file, go to the target S3 bucket > Permissions > Bucket policy.
  2. Paste the JSON policy into the editor.
  3. Click Save changes.
  4. Validate the results. Upload a file without encryption. The request should be denied.

Store the policy text in a separate place for reference, and so reviewers can confirm it later.

Step 4: Define KMS key policies and rotation

For SSE-KMS buckets, you need to restrict key use to specific IAM roles and services. To do that, you should:

  1. Go to the Amazon bucket that uses SSE-KMS encryption.
  2. Create a JSON file that follows the least privilege principle. Here’s a sample you can use for reference:
{

"Version": "2012-10-17",

"Id": "S3-KMS-Key-Policy",

"Statement": [

{

"Sid": "AllowKeyAdministration",

"Effect": "Allow",

"Principal": {

"AWS": "arn:aws:iam::111122223333:role/SecurityAdminRole"

},

"Action": "kms:*",

"Resource": "*"

},

{

"Sid": "AllowS3UseOfKeyForBucket",

"Effect": "Allow",

"Principal": {

"AWS": "arn:aws:iam::111122223333:role/DataBackupRole",

"Service": "s3.amazonaws.com"

},

"Action": [

"kms:Encrypt",

"kms:Decrypt",

"kms:ReEncrypt*",

"kms:GenerateDataKey*",

"kms:DescribeKey"

],

"Resource": "*",

"Condition": {

"StringEquals": {

"kms:ViaService": "s3.<region>.amazonaws.com",

"kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::your-bucket-name"

}

}

}

]

}

  1. Open AWS KMS > Customer managed keys > Your key > Key policy.
  2. Select Switch to policy view.
  3. Paste the JSON policy and click Save changes.

Step 5: Align transport to at-rest goals

Require TLS for clients and services that access protected buckets. Reference your HTTPS and TLS standards in the runbook so teams understand end-to-end posture.

  1. Go to your target bucket.
  2. Create a JSON file that blocks any access from devices using unencrypted HTTP (non-TLS). Here’s a sample for your reference:
{
"Version": "2012-10-17",
"Id": "EnforceTLSOnlyAccess",
"Statement": [
{
"Sid": "DenyInsecureTransport",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::your-bucket-name",
"arn:aws:s3:::your-bucket-name/*"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
  1. Go to S3 > Buckets > [your target bucket] > Permissions > Bucket policy.
  2. Paste the JSON policy and replace your-bucket-name with your actual name.
  3. Click Save changes.

Step 6: Validate coverage with S3 Inventory

  1. Choose or create a destination bucket where S3 Inventory reports will be delivered. Please note that:
    • It must be in the same AWS Region as the source bucket.
    • It must have the default encryption (SSE-S3 or SSE-KMS) enabled to protect the report itself.
  2. Create a dedicated folder for your report.
  3. Go to S3 > [your source bucket] > Management > Inventory configurations > Create inventory configuration.
  4. Configure the following:
    • Name: EncryptionStatusAudit
    • Destination: your chosen destination bucket and prefix.
    • Frequency: Daily or Weekly (daily recommended).
    • Output format: CSV
  5. Include the following fields:
    • Size
    • LastModifiedDate
    • StorageClass
    • EncryptionStatus
    • Enable server-side encryption for reports.
  6. Click Save changes to activate the inventory configuration.

The report will typically generate within 24 hours after you finish configuration. Download the results when ready and analyze the data provided.

Step 7: Detect drift with access logs and config checks

Once you have your data, review server access logs for denied unencrypted puts and unexpected principals using keys. If there are too many, there may be a bigger issue that you should look into.

Scan regularly to ensure that there are no buckets without default encryption or with permissive policies. If you find one, open a ticket with an owner and a due date to ensure that the issue is resolved.

Step 8: Test access and restore paths

Read a sample object to ensure that decryption works. If there are still unencrypted files getting through, go through your configurations again. For SSE-KMS, verify that key usage appears in logs. Save commands, timestamps, and short outputs.

Step 9: Operate controlled change

Only authorized personnel should make changes to bucket configurations. And any edit to the bucket or key policy should have a purpose, blast radius, rollback notes, and expiry for temporary changes. Keep a log of all these things to encourage transparency and accountability.

Step 10: Publish a monthly evidence packet

Create a packet for each tenant. These reports should include coverage from inventory, counts of denied unencrypted puts, key usage summaries, policy diffs, and open exceptions with owners and expiry.

Keep the report to one page so that executives can easily scan it and get the relevant information.

Best practices summary table for managing AWS S3 bucket server-side encryption configuration

PracticePurposeValue Delivered
Mode per bucketThis will match the control to the data class.This gives you a risk-aligned design and a clear cost.
Default encryption plus deny policyThis will make encryption non-optional for your buckets.This gives consistent coverage and easy audits.
Tight KMS governanceThis will limit who can decrypt.This gives separation of duties and traceability.
Inventory and logsThis will ensure continuous verification.This ensures you have fast QBRs and compliance checks.
Monthly packetThis will give you an executive-ready story.This gives you more trust and reduces review time.

NinjaOne integration ideas for AWS Key Management Service

You can use NinjaOne tools to:

Quick-Start Guide

NinjaOne can help implement Amazon S3 Server-Side Encryption with Guardrails through several capabilities:

NinjaOne Capabilities for S3 Encryption Guardrails

1. Policy-Based Enforcement

NinjaOne allows you to create policies that can enforce security configurations across your environment. While it doesn’t directly manage AWS S3 encryption settings, you can use NinjaOne policies to:

  • Ensure agents have proper configurations to interact with encrypted S3 buckets
  • Deploy scripts that verify S3 bucket encryption settings
  • Create alerts when unencrypted data is detected

2. Monitoring and Alerting

NinjaOne provides monitoring capabilities that can help with S3 encryption guardrails:

  • Monitor agent connectivity to S3 services
  • Alert on policy violations related to data protection
  • Track encryption status through custom scripts

3. Automation

Through NinjaOne scripts, you can automate:

  • Verification of S3 bucket encryption settings
  • Enforcement of encryption policies across multiple AWS accounts
  • Remediation actions when encryption requirements aren’t met

4. Integration with AWS

NinjaOne integrates with AWS services, allowing you to:

  • Monitor AWS resource configurations
  • Respond to security events related to S3 access
  • Implement guardrails through AWS-native services that NinjaOne can monitor

Manage AWS S3 server-side encryption properly with the right knowledge

S3 server-side encryption is a reliable security guardrail when you choose the right mode, enforce by default, govern keys carefully, and verify coverage with inventory and logs. By publishing a simple monthly packet, you make the control auditable and keep stakeholders aligned.

Related topics:

FAQs

Use SSE-KMS instead of SSE-S3 when you need granular access control, audit logging, and key management beyond what S3 provides by default.

Yes. You should still enable default encryption, even if you have S3 bucket policies that deny unencrypted uploads. Default encryption acts as a safety net. If a user or application uploads data without specifying encryption headers, S3 automatically applies encryption using your defined default (SSE-S3 or SSE-KMS).

Server-Side Encryption (SSE):

  • Encryption happens within AWS S3 before data is written to disk.
  • AWS manages the keys using SSE-S3 (AES-256) or SSE-KMS (KMS-managed keys).
  • Ideal for most organizations because it provides automated key management, logging, and integration with IAM and KMS.

Client-Side Encryption (CSE):

  • Data is encrypted before uploading to S3 using a client application or SDK.
  • You control key creation, storage, and rotation independently of AWS.
  • Offers maximum control but increases operational overhead and complexity.

AWS recommends rotating customer-managed KMS keys annually to align with security and compliance frameworks like NIST 800-57, ISO 27001, and CIS AWS Foundations Benchmark.

You might also like

Ready to simplify the hardest parts of IT?