Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

S3 bucket uses SSE-KMS without an S3 Bucket Key

AWS_OPS_053 LOW Cost

What it checks

S3 bucket uses SSE-KMS without an S3 Bucket Key

Where it applies

Terraform: aws_s3_bucket_server_side_encryption_configuration, aws_s3_bucket

CloudFormation: AWS::S3::Bucket

How to fix it

  1. Review IAM and KMS key policies: the encryption context changes from the object ARN to the bucket ARN. Preserve the existing encryption algorithm and KMS key, including the default aws/s3 key when no key is specified.
  2. Enable for new objects only after review. Existing objects require an explicit CopyObject operation to adopt Bucket Keys; assess migration costs and permissions first.
  3. Update monitoring: KMS CloudTrail events use the bucket ARN and become fewer. Requests using a cached bucket-level key do not revalidate the KMS key policy; do not rely on immediate key-policy revocation for those cached requests.
  4. Review replication and applications that use ETags: a previously unencrypted source replicated into a destination using encryption or Bucket Keys can have a different replica ETag. This is not a universal ETag change for every replication pair.

Frameworks

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules