From 2a641b39c8a8da6eae071593f00ffe9cea4596c3 Mon Sep 17 00:00:00 2001 From: OokaToru Date: Fri, 29 May 2026 21:41:52 +0900 Subject: [PATCH] chore(s3): deprecate `s3_bucket_default_encryption` check (#11230) Co-authored-by: Hugo P.Brito --- prowler/CHANGELOG.md | 1 + .../s3_bucket_default_encryption.metadata.json | 10 ++++------ 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index fedc6eecb8..d75e189be8 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -18,6 +18,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - ENS RD 311/2022 (AWS) compliance mapping: `vpc_different_regions` was uncorrectly mapped under the `mp.com.4` family (Network segregation). That check is now mapped to a new `op.cont.2.aws.vpc.1` requirement under the Continuity of Service control [(#11372)](https://github.com/prowler-cloud/prowler/pull/11372) - Compliance CSV row count now matches the UI per requirement by sourcing rows from the framework JSON's `requirement.Checks` instead of the stale `finding.compliance` snapshot [(#11370)](https://github.com/prowler-cloud/prowler/pull/11370) - OpenStack provider exception codes moved from the `10000-10999` range, shared with the AlibabaCloud provider, to the free `17000-17999` range to keep error codes unambiguous [(#11382)](https://github.com/prowler-cloud/prowler/pull/11382) +- Deprecate `s3_bucket_default_encryption` check for AWS provider since SSE-S3 is automatically applied to all S3 buckets by AWS as of January 5, 2023 and can no longer be disabled [(#11230)](https://github.com/prowler-cloud/prowler/pull/11230) --- diff --git a/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.metadata.json index eb0c07e8af..bda2595347 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.metadata.json @@ -1,7 +1,7 @@ { "Provider": "aws", "CheckID": "s3_bucket_default_encryption", - "CheckTitle": "S3 bucket has default server-side encryption (SSE) enabled", + "CheckTitle": "[DEPRECATED] S3 bucket has default server-side encryption (SSE) enabled", "CheckType": [ "Software and Configuration Checks/AWS Security Best Practices", "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", @@ -14,13 +14,11 @@ "Severity": "medium", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "**Amazon S3 buckets** have a default **server-side encryption** setting that automatically encrypts new objects using `SSE-S3` or `SSE-KMS`. This evaluates whether a bucket has a default encryption configuration defined.", + "Description": "[DEPRECATED] **Amazon S3 buckets** have a default **server-side encryption** setting that automatically encrypts new objects using `SSE-S3` or `SSE-KMS`. This evaluates whether a bucket has a default encryption configuration defined.", "Risk": "Without default encryption, older objects may remain unencrypted and new uploads won't be forced to use `SSE-KMS`. This reduces confidentiality and governance by limiting key audit logs, rotation, and cross-account controls, and increases exposure if data is copied, replicated, or accessed outside intended paths.", "RelatedUrl": "", "AdditionalURLs": [ - "https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/bucket-encryption.html", - "https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/", - "https://docs.aws.amazon.com/us_en/AmazonS3/latest/userguide/default-encryption-faq.html" + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html" ], "Remediation": { "Code": { @@ -39,5 +37,5 @@ ], "DependsOn": [], "RelatedTo": [], - "Notes": "" + "Notes": "This check is being deprecated since AWS automatically applies SSE-S3 to every S3 bucket (both new buckets and previously-unencrypted existing buckets) as of January 5, 2023, and encryption can no longer be disabled. For SSE-KMS validation, use `s3_bucket_kms_encryption` instead." }