- Newest
- Most votes
- Most comments
Starting January 5, 2023, the automatic encryption status for S3 bucket default encryption configuration and all new object uploads is visible in AWS CloudTrail logs across all AWS Regions, including the AWS GovCloud (US) Regions and the AWS China Regions. Over the next few weeks, we will roll out this automatic encryption status to the Amazon S3 console, S3 Inventory, S3 Storage Lens, and Amazon S3 API responses in the AWS CLI and AWS SDKs in all Regions. During the next few weeks, the automatic encryption status will also be rolled out to the Amazon S3 console, S3 Inventory, S3 Storage Lens, and as an additional Amazon S3 API response header in the AWS Command Line Interface and AWS SDKs. When this update is complete in all AWS Regions, we will update the documentation.
Will Amazon S3 encrypt my existing objects that are unencrypted? No. Beginning on January 5, 2023, Amazon S3 only automatically encrypts new object uploads. To encrypt existing objects, you can use S3 Batch Operations to create encrypted copies of your objects. These encrypted copies will retain the existing object data and name and will be encrypted by using the encryption keys that you specify.
Above answers referenced from: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html
answered 4 years ago
It is encouraging to see Amazon S3 continue to evolve by introducing native capabilities that simplify encryption for both new and existing objects. These enhancements reflect the increasing importance of secure by default cloud architectures and stronger protection of data at rest.
Several years before these native capabilities became available, I designed and implemented an enterprise scale remediation framework to identify, validate, and encrypt more than six million existing Amazon S3 objects containing HIPAA regulated Protected Health Information. At the time, organizations operating large scale AWS environments faced significant compliance challenges because enabling default encryption protected only future uploads and did not remediate existing unencrypted data.
The solution leveraged Amazon S3 Inventory, AWS Glue, Amazon Athena, S3 Batch Operations, and Python based orchestration to automate the discovery, encryption, validation, and replacement of existing objects while preserving object integrity and minimizing operational disruption. This approach enabled the organization to restore HIPAA compliance across millions of legacy objects without disrupting production workloads.
From my experience, a comprehensive data protection strategy should include both automatic encryption for all new object uploads and an automated remediation process for legacy data that already exists within Amazon S3. Together, these capabilities provide organizations with a scalable approach to achieving and maintaining long term compliance.
For anyone interested in the technical architecture and implementation details, I have documented the complete solution here, that was implemented that time
I had to Encrypt 6 Million objects using the Method i designed and Implemented brining the organization into HIPAA compliance as it was under non-complaint.
https://www.linkedin.com/pulse/handling-unencrypted-aws-s3-objects-security-compliance-salim-aftab/
answered a month ago
Relevant content
asked 2 years ago
