Evaluates whether each Object Storage Service (OSS) bucket uses a custom KMS key for encryption. If so, the result is Compliant.
Scenarios
Use this rule to verify that OSS buckets are encrypted with a custom Key Management Service (KMS) key, ensuring that business data at rest meets security compliance requirements.
Risk level
Default risk level: medium.
You can change the risk level when you configure this rule.
Compliance evaluation logic
- If the Encryption Method of an OSS bucket is set to KMS, the evaluation result is Compliant.
- If the Encryption Method of an OSS bucket is not set to KMS, the evaluation result is Incompliant. To remediate this, see Incompliance remediation.
Rule details
| Item | Description |
| Rule name | oss-encryption-byok-check |
| Rule identifier | oss-encryption-byok-check |
| Tag | OSS and Bucket |
| Automatic remediation | Not supported |
| Trigger type | Configuration change |
| Supported resource type | OSS buckets |
| Input parameter | None |
Incompliance remediation
Set the Encryption Method parameter of an OSS bucket to KMS. For more information, see Server-side encryption.