AWS Storage Services

Enhancing S3 Bucket Security by Prohibiting Uploads of Unencrypted Objects

1 min read
Updated June 22, 2025
757 characters

{

"Version": "2012-10-17",

"Statement": [

{

  "Sid": "DenyIncorrectEncryptionHeader",

  "Effect": "Deny",

  "Principal": "*",

  "Action": "s3:PutObject",

  "Resource": "arn:aws:s3:::my-secure-bucket/*",

  "Condition": {

    "StringNotEquals": {

      "s3:x-amz-server-side-encryption": "aws:kms"

    }

  }

},

{

  "Sid": "DenyIncorrectKMSKey",

  "Effect": "Deny",

  "Principal": "*",

  "Action": "s3:PutObject",

  "Resource": "arn:aws:s3:::my-secure-bucket/*",

  "Condition": {

    "ArnNotEquals": {

      "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id"

    }

  }

}

]

}