prowler
prowler copied to clipboard
Remove S3 KMS check, since its enabed by default, and cant be disabled
Steps to Reproduce
Here is the check: https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/services/s3/s3_bucket_kms_encryption/s3_bucket_kms_encryption.py
Here is the documentation: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html
Here is the relevant part of the documentation:
Can I disable encryption for the new objects being written to my bucket?
No. SSE-S3 is the new base level of encryption that's applied to all the new objects being uploaded to your bucket. You can no longer disable encryption for new object uploads.
Expected behavior
Remove the check
Actual Result with Screenshots or Logs
None
How did you install Prowler?
Cloning the repository from github.com (git clone)
Environment Resource
None
OS used
None
Prowler version
None
Pip version
None
Context
No response
I actually think its this check that needs to be removed: https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.py
The KMS one might still apply, as I think it is checking that you use a customer-managed KMS key, but the status_extended and metadata info seem to only mention using some form of encryption - not that it is a customer-managed key in particular.
Hi @Fennerr, you are right. We will deprecate s3_bucket_default_encryption
check soon. Thanks for letting us know!