jnchonon6FNdGO2PKBh4Check which AWS S3 buckets have Server Side Encryption enabled
Check which AWS S3 buckets have Server Side Encryption enabled
There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
This task assesses whether AWS S3 buckets have default server-side encryption activated or if their bucket policies explicitly deny any put-object requests that lack server-side encryption, specifically using AES-256 or AWS KMS. It designates S3 buckets as NON_COMPLIANT if they are not set to be encrypted by default.
inputs
outputs
# Compliance Rule: s3-bucket-server-side-encryption-enabled
# This rule checks each S3 bucket for two key criteria:
# 1. Default Encryption: The bucket must have server-side encryption enabled by default,
# using either AES-256 or AWS KMS.
# 2. Policy Compliance: The bucket policy must explicitly deny put-object requests that
# are not accompanied by server-side encryption using AES-256 or AWS KMS.
# A bucket is considered NON_COMPLIANT if it does not have default encryption enabled.
import boto3
from botocore.exceptions import ClientError, NoCredentialsError, BotoCoreError
import json
creds = _get_creds(cred_label)['creds']
access_key = creds['username']
secret_key = creds['password']
def is_encryption_enabled(bucket_name):
"""
Check if the specified S3 bucket has server-side encryption enabled.
"""
s3 = boto3.client('s3',aws_access_key_id=access_key,aws_secret_access_key=secret_key)
try:
# Attempt to retrieve the bucket encryption configuration
encryption = s3.get_bucket_encryption(Bucket=bucket_name)
#print(encryption) # for debugging
# If this call is successful, encryption is enabled
return True
except ClientError as e:
if e.response['Error']['Code'] == 'ServerSideEncryptionConfigurationNotFoundError':
# Encryption is not enabled
return False
else:
# Other errors
raise
def is_policy_compliant(bucket_name):
"""
Check if the bucket policy explicitly denies put-object requests without server-side encryption.
"""
s3 = boto3.client('s3',aws_access_key_id=access_key,aws_secret_access_key=secret_key)
try:
policy = s3.get_bucket_policy(Bucket=bucket_name)
policy_document = json.loads(policy['Policy'])
#print(f"Policy for bucket '{bucket_name}': {policy_document}") # Debug statement
for statement in policy_document.get('Statement', []):
if statement.get('Effect') == 'Deny':
actions = statement.get('Action', [])
if isinstance(actions, str):
actions = [actions]
if any(action.startswith('s3:Put') for action in actions):
conditions = statement.get('Condition', {}).get('StringEquals', {})
encryption_condition = conditions.get('s3:x-amz-server-side-encryption', None)
if encryption_condition in ['AES256', 'aws:kms']:
#print(f"Bucket '{bucket_name}' has a compliant policy with encryption requirement.") # Debug statement
return True
#print(f"Bucket '{bucket_name}' does not have a compliant policy with encryption requirement.") # Debug statement
return False
except ClientError as e:
if e.response['Error']['Code'] == 'NoSuchBucketPolicy':
#print(f"No policy for bucket '{bucket_name}'.") # Debug statement
return False
else:
raise
def check_all_buckets_for_encryption():
"""
Check all S3 buckets in the account for server-side encryption and compliance with bucket policy.
"""
try:
s3 = boto3.client('s3',aws_access_key_id=access_key,aws_secret_access_key=secret_key)
buckets = s3.list_buckets().get('Buckets', [])
if not buckets:
print("No S3 buckets found in the account.")
return
for bucket in buckets:
bucket_name = bucket['Name']
encrypted = is_encryption_enabled(bucket_name)
policy_compliant = is_policy_compliant(bucket_name)
# A bucket is considered NON_COMPLIANT if it does not have default encryption enabled.
if encrypted:
if policy_compliant:
print(f"Bucket '{bucket_name}' is COMPLIANT with server-side encryption and has a compliant policy.")
else:
print(f"Bucket '{bucket_name}' is COMPLIANT with server-side encryption but does not have a compliant policy.")
else:
print(f"Bucket '{bucket_name}' is NON_COMPLIANT with server-side encryption.")
except NoCredentialsError:
print("No AWS credentials found. Please configure your credentials.")
except BotoCoreError as e:
print(f"An error occurred accessing AWS S3 service: {e}")
except Exception as e:
print(f"An unexpected error occurred: {e}")
check_all_buckets_for_encryption()
context.skip_sub_tasks=True
copied
- 1dsaM2cTMEFx0aTxNVYHCAWS S3 Bucket Encryption Setup and Status Verification Process
1
AWS S3 Bucket Encryption Setup and Status Verification Process
There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.This task involves enabling AES-256 server-side encryption on S3 buckets and verifying its activation. This process ensures data security by encrypting contents within the buckets. By default all new buckets created are encrypted but this task beneficial for legacy buckets without encryption enabled.
inputsoutputsimport boto3 from botocore.exceptions import ClientError, BotoCoreError creds = _get_creds(cred_label)['creds'] access_key = creds['username'] secret_key = creds['password'] def enable_and_verify_bucket_encryption(bucket_name): """ Enable default AES-256 server-side encryption on the specified S3 bucket and verify the encryption status. """ s3 = boto3.client('s3',aws_access_key_id=access_key,aws_secret_access_key=secret_key) encryption_configuration = {'Rules': [{'ApplyServerSideEncryptionByDefault': {'SSEAlgorithm': 'AES256'}}]} try: s3.put_bucket_encryption(Bucket=bucket_name, ServerSideEncryptionConfiguration=encryption_configuration) response = s3.get_bucket_encryption(Bucket=bucket_name) if response['ResponseMetadata']['HTTPStatusCode'] == 200: print(f"Encryption successfully enabled on bucket '{bucket_name}'.") else: print(f"Failed to verify encryption on bucket '{bucket_name}'.") except ClientError as e: print(f"AWS ClientError: {e.response['Error']['Message']}") except BotoCoreError as e: print(f"BotoCoreError: {e}") except Exception as e: print(f"An unexpected error occurred: {e}") #bucket_name = 'test-sse-encryption-bucket-123' enable_and_verify_bucket_encryption(bucket_name)copied1