Mandate Encryption for Data at Rest (EBS & S3)
Specification & Description
Enforce encryption by default for EBS volumes and S3 buckets across the organization using AWS Organizations SCPs, EC2 account-level defaults, and S3 bucket-level default encryption settings.
Technical Specifications
Encrypting data at rest is a fundamental security requirement in any landing zone. AWS provides two complementary mechanisms that operate at different layers. At the account level, EC2 offers an "EBS encryption by default" setting that automatically encrypts all newly created EBS volumes and snapshots using a KMS key - either the AWS-managed default (aws/ebs) or a customer-managed key (CMK). At the organizational level, an SCP can deny any s3:PutObject request that lacks a valid server-side encryption header, preventing unencrypted object uploads regardless of bucket policy. Together with S3 bucket default encryption (SSE-S3 or SSE-KMS), these controls form a defense-in-depth approach that does not rely on individual developer or operator action in member accounts.
Security Rationale
Encryption at rest protects data from unauthorized access if physical storage media is compromised, decommissioned insecurely, or accessed by cloud provider staff. It is a baseline requirement in virtually every regulatory framework (PCI DSS, HIPAA, NIST, ISO 27001). Centralizing enforcement via SCP and account-level defaults removes the dependency on per-bucket or per-volume configuration, eliminating human error as a gap vector in landing zone accounts.
Policy Exceptions (2)
Accounts in the sandbox OU may be granted a time-limited exception for the S3 SCP to permit unencrypted uploads during proof-of-concept work, subject to security team approval and a maximum duration of e.g. 30 days.
Legacy EBS volumes created before this control was enforced are exempt from retroactive re-encryption if the data owner provides a risk acceptance.
Operational & Implementation Notes
BucketKeyEnabled should always be set to true on SSE-KMS configurations to reduce KMS API call volume and associated costs at scale. When selecting between SSE-S3 and SSE-KMS, prefer SSE-KMS in regulated workloads where independent key audit trails (CloudTrail KMS events) and key rotation policies are required. The DenyUnencryptedS3Uploads SCP uses StringNotLikeIfExists to avoid breaking bucket-to-bucket replication or pre-signed URL flows that do not pass the header explicitly - test in a non-production OU before promoting to root.