Control: AWS > S3 > Bucket > Encryption at Rest
Define the Encryption at Rest settings required for AWS > S3 > Bucket
.
Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.
The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (AWS > S3 > Bucket > Encryption at Rest > *
), raises an alarm, and takes the defined enforcement action.
Resource Types
This control targets the following resource types:
Policies
The following policies can be used to configure this control:
This control type relies on these other policies when running actions:
Quick Actions
- Skip alarm for Encryption at Rest control
- Skip alarm for Encryption at Rest control [90 days]
- Set Encryption at Rest to None
- Set Encryption at Rest to AWS SSE
- Set Encryption at Rest to AWS Managed Key
- Set Encryption at Rest to Customer Managed Key
Permissions
Cloud permissions used by this control and its actions:
s3:DeleteBucketEncryption
s3:PutEncryptionConfiguration
s3:DeleteBucketPolicy
s3:PutBucketEncryption
s3:PutBucketPolicy
Category
In Your Workspace
Developers
- tmod:@turbot/aws-s3#/control/types/bucketEncryptionAtRest
- tmod:@turbot/turbot#/control/categories/resourceEncryptionAtRest
- turbot graphql controls --filter "controlTypeId:tmod:@turbot/aws-s3#/control/types/bucketEncryptionAtRest"
Get Controls
Control Type URI
Category URI
GraphQL
CLI