Policy Packs

guardrails-samples

Safeguard sensitive data that is stored in the S3 buckets, protecting it from unauthorized access and potential breaches.

Enforce Encryption at Rest Is Enabled for AWS S3 Buckets

main

aws_s3_bucket_encryption_at_rest

Define the Encryption at Rest settings required for `AWS &gt; S3 &gt; Bucket`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; S3 &gt; Bucket &gt; Encryption at Rest  &gt; *`), raises an alarm, and takes the defined enforcement action.&#92;n&#92;n**Note**: The below policy values are deprecated and will be removed in the next major mod version because they are no longer supported by AWS.&#92;n&#92;n| Deprecated Values                   |&#92;n|-------------------------------------|&#92;n| Check: None         |&#92;n| Check: None or higher   |&#92;n| Enforce: None   |&#92;n| Enforce: None or higher  |&#92;n

bucketEncryptionAtRest

AWS > S3 > Bucket > Encryption at Rest

aws_s3_bucket_encryption_at_rest_customer_managed_key

Define the KMS key ID for encryption at rest.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; S3 &gt; Bucket &gt; Encryption at Rest  &gt; *`), raises an alarm, and takes the defined enforcement action&#92;n&#92;nPlease make sure the key defined in the template has required permissions.&#92;n&#92;n```&#92;nexample:&#92;n  alias/aws/ebs&#92;n  ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n```&#92;n

bucketEncryptionAtRestCustomerManagedKey

AWS > S3 > Bucket > Encryption at Rest > Customer Managed Key

turbot_policy_setting.aws_s3_bucket_encryption_at_rest

turbot_policy_setting.aws_s3_bucket_encryption_at_rest_customer_managed_key

Policy	Setting	Note
AWS > S3 > Bucket > Encryption at Rest	Check: AWS managed key or higher
AWS > S3 > Bucket > Encryption at Rest > Customer Managed Key	alias/turbot/default

Policy Settings