Control: 5.8 Ensure server-side encryption is set to 'Encrypt with Service Key'
Description
Enable server-side encryption (Encrypt with Service Key) for objects.
Remediation
From Console
Perform the following to configure the OSS bucket to use SSE-KMS:
- Logon to OSS console.
- In the bucket-list pane, click on the target OSS bucket.
- Click
Basic Settingin top middle of the console. - Under the
Server-side Encryptionsection, click onConfigure. - Click
KMSand selectKMS service key(alias/acs/oss).
Usage
Run the control in your terminal:
powerpipe control run alicloud_compliance.control.cis_v100_5_8Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run alicloud_compliance.control.cis_v100_5_8 --shareSQL
This control uses a named query:
select 'acs:oss:::' || b.name as resource, case when server_side_encryption ->> 'SSEAlgorithm' = 'KMS' and k.creator = 'Oss' then 'ok' else 'alarm' end as status, case when server_side_encryption ->> 'SSEAlgorithm' = 'KMS' and k.creator = 'Oss' then b.title || ' encrypted with Service Key.' else b.title || ' not encrypted with Service Key.' end as reason , b.account_id as account_id, b.region as regionfrom alicloud_oss_bucket b left join alicloud_kms_key k on b.server_side_encryption ->> 'KMSMasterKeyID' = k.key_id;