Control: 5.9 Ensure server-side encryption is set to 'Encrypt with BYOK'
Description
Enable server-side encryption (Encrypt with Service Key) for objects.
Remediation
From Console
Perform the following to configure the OSS bucket to use SSE-KMS:
- Logon to OSS console.
- In the bucket-list pane, click on the target OSS bucket.
- Click
Basic Settingin top middle of the console. - Under the
Server-side Encryptionsection, click onConfigure. - Click
KMSand selectKMS service key(alias/acs/oss).
Usage
Run the control in your terminal:
powerpipe control run alicloud_compliance.control.cis_v100_5_9Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run alicloud_compliance.control.cis_v100_5_9 --shareSQL
This control uses a named query:
oss_bucket_encrypted_with_byok