How to Enable Default Encryption on an S3 Bucket

What default encryption does

Default bucket encryption tells S3 to encrypt every object on write, regardless of whether the upload requested it. Without it, a client that omits the x-amz-server-side- encryption header stores the object in plaintext - which is exactly what compliance scans flag. Turning it on closes that gap for all future PUTs.

Enable SSE-S3 (AES256) - the simple default

S3-managed keys, nothing else to set up:

aws s3api put-bucket-encryption \
  --bucket customer-data \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}
    }]
  }'

Or SSE-KMS - when you need key control / audit

Use a KMS key if you need rotation, access policies, or CloudTrail logging of key use:

aws s3api put-bucket-encryption \
  --bucket customer-data \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "arn:aws:kms:...:key/abc-123"
      },
      "BucketKeyEnabled": true
    }]
  }'

BucketKeyEnabled cuts KMS costs by reducing per-object KMS calls.

Verify

aws s3api get-bucket-encryption --bucket customer-data

A few important notes

• Default encryption only applies to new objects. Existing objects stay as they were - re-upload or run a batch copy to encrypt them.
• It doesn't block plaintext intent - to reject unencrypted uploads outright, add a bucket policy that denies PUTs without the SSE header.
• SSE-S3 vs SSE-KMS: SSE-S3 (AES256) is free and zero-config; SSE-KMS adds key control + audit at a small per-request cost.