Score:0

Deny unencrypted s3 buckets via SCP

it flag

Folks just wondering if there’s ability to attach a SCP to OU accounts denying S3 buckets from being created if default encryption is not opted upfront.

From cloud trail it’s apparent that PutBucketEncryption and CreateBucket are two seperate Api calls and the former Api is responsible for applying the encryption settings post bucket creation.

Also CreateBucket doesn’t take in encryption via headers in it’s Api call.

So adding a condition like below might not yield at all.

"StringNotEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}

Any leads guys? Appreciate your responses. Cheers!

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.