prowler icon indicating copy to clipboard operation
prowler copied to clipboard

Remove S3 KMS check, since its enabed by default, and cant be disabled

Open Fennerr opened this issue 1 year ago • 2 comments

Steps to Reproduce

Here is the check: https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/services/s3/s3_bucket_kms_encryption/s3_bucket_kms_encryption.py

Here is the documentation: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html

Here is the relevant part of the documentation:

Can I disable encryption for the new objects being written to my bucket?

No. SSE-S3 is the new base level of encryption that's applied to all the new objects being uploaded to your bucket. You can no longer disable encryption for new object uploads.

Expected behavior

Remove the check

Actual Result with Screenshots or Logs

None

How did you install Prowler?

Cloning the repository from github.com (git clone)

Environment Resource

None

OS used

None

Prowler version

None

Pip version

None

Context

No response

Fennerr avatar Feb 14 '24 13:02 Fennerr

I actually think its this check that needs to be removed: https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.py

The KMS one might still apply, as I think it is checking that you use a customer-managed KMS key, but the status_extended and metadata info seem to only mention using some form of encryption - not that it is a customer-managed key in particular.

Fennerr avatar Feb 14 '24 13:02 Fennerr

Hi @Fennerr, you are right. We will deprecate s3_bucket_default_encryption check soon. Thanks for letting us know!

sergargar avatar Feb 26 '24 10:02 sergargar