Control: 5.9 Ensure server-side encryption is set to 'Encrypt with BYOK'

Description

Enable server-side encryption (Encrypt with BYOK) for objects.

Remediation

Perform the following to configure the OSS bucket to use SSE-KMS:

Using the management console:

Logon to OSS console.
In the bucket-list pane, click on the target OSS bucket.
Click on Basic Setting in top middle of the console.
Under the Server-side Encryption section, click on Configure.
Click on KMS and select an existing CMK from the KMS key Id drop-down menu.
Click Save.

Default Value:

By default, Buckets are not set to be encrypted.

Usage

Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v200_5_9

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v200_5_9 --share

SQL

This control uses a named query:

select
  'acs:oss:::' || b.name as resource,
  case
    when server_side_encryption ->> 'SSEAlgorithm' = 'KMS' and k.creator = k.account_id then 'ok'
    else 'alarm'
  end as status,
  case
    when server_side_encryption ->> 'SSEAlgorithm' = 'KMS' and k.creator = k.account_id then b.title || ' encrypted with BYOK.'
    else b.title || ' not encrypted with BYOK.'
  end as reason
  
  , b.account_id as account_id, b.region as region
from
  alicloud_oss_bucket b
  left join alicloud_kms_key k on b.server_side_encryption ->> 'KMSMasterKeyID' = k.key_id;