AWS S3 Bucket Enable Encryption

Serverless Framework
1

SLS provides configuration settings to define buckets created by SLS to be encrypted. I am looking for an example were I can use the same syntax to encrypt my buckets I defined as resources in my ssl yaml file

Thank you in advance.

2

You can enable default server-side encryption in the resources (cloudformation) section of your serverless.yml file. Example for AES256 encryption:

resources:
  Resources:
    MyDefaultEncryptedBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: mydefaultencryptedbucket
        BucketEncryption:
          ServerSideEncryptionConfiguration:
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: AES256

See also cloudformation user guide: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-bucketencryption.html

If you want to enforce encryption, you have to add a policy: https://aws.amazon.com/de/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/

1 Like
3

JSON:
{
“Resources”: {
“MyBucket”: {
“Type” : “AWS::S3::Bucket”,
“Properties” : {
“BucketEncryption”: {
“ServerSideEncryptionConfiguration”: [
{
“ServerSideEncryptionByDefault”: {
“SSEAlgorithm”: “AES256”
}
}
]
}
}
}
}
}