S3 general purpose buckets should be encrypted at rest with AWS KMS keys

How to fix it

• Can break clients: Uploads then need kms:GenerateDataKey and downloads kms:Decrypt on the key, so with a customer managed key, grant both to every principal that uses the bucket before you switch.

In the console

S3 → the bucket → Properties → Default encryption

Encryption type

Server-side encryption with AWS Key Management Service keys (SSE-KMS)

AWS KMS key

A symmetric key in the bucket's Region; a customer managed key if another account must read the objects

Bucket Key

Enable, to cut KMS request costs (not available with DSSE-KMS)

With the AWS CLI

aws s3api put-bucket-encryption --bucket <bucket-name> --server-side-encryption-configuration file://encryption.json

With Terraform

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = var.bucket_name

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = var.kms_key_arn
    }

    bucket_key_enabled = true
  }
}