An OSS bucket is considered compliant if server-side encryption using KMS is enabled.
Scenarios
If your security and compliance rules require you to encrypt data in an OSS bucket with your own key, you can use a key managed by KMS. This enables data-at-rest encryption and secures your business data.
Risk level
Default risk level: High.
You can change the risk level for this rule as needed.
Detection logic
An OSS bucket is considered compliant if server-side encryption using KMS is enabled.
An OSS bucket is considered non-compliant if server-side encryption using KMS is not enabled. To remediate this issue, see Remediation.
Rule details
Parameter | Description |
Rule name | Enable server-side KMS encryption for OSS buckets |
Rule identifier | oss-default-encryption-kms |
Tags | OSS, Bucket |
Auto-remediation | Not supported |
Rule trigger mechanism | Configuration changes |
Supported resource types | OSS bucket |
Rule input parameters | None |
Remediation
You can enable server-side encryption for the OSS bucket using KMS. For more information, see Server-side encryption.