Force Server Side Encryption for S3 Bucket

amazon-s3, amazon-web-services, emr, encryption

Solution

Amazon just released new features for enforcing this, making it very easy

Excerpt from the docs on setting this up.

Note that any exiting bucket policies will be evaluated prior to any bucket encryption settings

Amazon S3 evaluates and applies bucket policies before applying bucket encryption settings. Even if you enable bucket encryption settings, your PUT requests without encryption information will be rejected if you have bucket policies to reject such PUT requests . Check your bucket policy and modify it if required

Problem

I want to set an S3 bucket policy so that all requests to upload to that bucket will use server side encryption, even if it is not specified in the request header. I have seen this post (Amazon S3 Server Side Encryption Bucket Policy problems) where someone has managed to set a bucket policy that denies all put requests that don't specify server side encryption, but I don't want to deny, I want the puts to succeed but use server side encryption. My issue is with streaming the output from EMR to my S3 bucket, I don't control the code that is making the requests, and it seems to me that server side encryption must be specified on a per request basis.

Original source