How to Prevent Uploads of Unencrypted Objects to Amazon S3

Navigate to AWS Console: https://console.aws.amazon.com
Navigate to S3 from service menu > Select a S3 bucket > Permission tab > Bucket Policy

Now you would need to paste the bucket policy which will enforce encryption on your bucket

Using SSE-S3 managed keys

{
     "Version": "2012-10-17",
     "Id": "PutObjPolicy",
     "Statement": [
           {
                "Sid": "DenyIncorrectEncryptionHeader",
                "Effect": "Deny",
                "Principal": "*",
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::<bucket_name>/*",
                "Condition": {
                        "StringNotEquals": {
                               "s3:x-amz-server-side-encryption": "AES256"
                         }
                }
           },
           {
                "Sid": "DenyUnEncryptedObjectUploads",
                "Effect": "Deny",
                "Principal": "*",
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::<bucket_name>/*",
                "Condition": {
                        "Null": {
                               "s3:x-amz-server-side-encryption": true
                        }
               }
           }
     ]
 }

Using SSE-KMS managed keys

{
       "Version": "2012-10-17",
       "Id": "PutObjPolicy",
       "Statement": [
           {
                "Sid": "DenyIncorrectEncryptionHeader",
                "Effect": "Deny",
                "Principal": "*",
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::<bucket_name>/*",
                "Condition": {
                    "StringNotEquals": {
                          "s3:x-amz-server-side-encryption": "aws:kms"
                             }
                   }
           },
           {
                "Sid": "DenyUnEncryptedObjectUploads",
                "Effect": "Deny",
                "Principal": "*",
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::<bucket_name>/*",
                "Condition": {
                    "Null": {
                          "s3:x-amz-server-side-encryption": true
                            }
                    }
           }
    ]
}

Once you paste the policy of your encryption choose, try to upload something without selecting encryption setting it will fail
Now try upload some file with encryption setting checked, it will be upload sucessfully

How to Prevent Uploads of Unencrypted Objects to Amazon S3

Ads Blocker Detected!!!