Force Server Side Encryption for S3 Bucket
amazon-s3, amazon-web-services, emr, encryption
Solution
Amazon just released new features for enforcing this, making it very easy
Excerpt from the docs on setting this up.
Note that any exiting bucket policies will be evaluated prior to any bucket encryption settings
Amazon S3 evaluates and applies bucket policies before applying bucket encryption settings. Even if you enable bucket encryption settings, your PUT requests without encryption information will be rejected if you have bucket policies to reject such PUT requests . Check your bucket policy and modify it if required
Problem
I want to set an S3 bucket policy so that all requests to upload to that bucket will use server side encryption, even if it is not specified in the request header. I have seen this post (Amazon S3 Server Side Encryption Bucket Policy problems) where someone has managed to set a bucket policy that denies all put requests that don't specify server side encryption, but I don't want to deny, I want the puts to succeed but use server side encryption. My issue is with streaming the output from EMR to my S3 bucket, I don't control the code that is making the requests, and it seems to me that server side encryption must be specified on a per request basis.