s3-default-encryption-kms - AWS Config


Checks if the S3 buckets are encrypted with AWS Key Management Service (AWS KMS). The rule is NON_COMPLIANT if the S3 bucket is not encrypted with an AWS KMS key.


Resource Types: AWS::S3::Bucket, AWS::KMS::Key

Trigger type: Configuration changes

AWS Region: All supported AWS regions except Asia Pacific (Hyderabad), Asia Pacific (Osaka), Canada West (Calgary), Europe (Spain) Region


kmsKeyArns (Optional)
Type: CSV

Comma separated list of AWS KMS key ARNs allowed for encrypting Amazon S3 Buckets.

AWS CloudFormation template

To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.