CODEWITHSUNDEEP
pythonamazon-web-servicesencryptionboto3
user10576684
user10576684

Reputation:

boto3 aws check if s3 bucket is encrypted

I have the following code posted below which gets all the s3 bucket list on aws and I am trying to write code that checks if the buckets are encrypted in python but I am having trouble figuring out how to do that. Can anyone tell me how to modify my code to do that. I tried online examples and looked at the documentation.

my code is:

 from __future__ import print_function
 import boto3
 import os

 os.environ['AWS_DEFAULT_REGION'] = "us-east-1"
 # Create an S3 client
 s3 = boto3.client('s3')
 # Call S3 to list current buckets

 response = s3.list_buckets()

 # Get a list of all bucket names from the response
 buckets = [bucket['Name'] for bucket in response['Buckets']]

 # Print out the bucket list
 print("Bucket List: %s" % buckets)

Tried the following codes but they don't work:

 s3 = boto3.resource('s3')
 bucket = s3.Bucket('my-bucket-name')
 for obj in bucket.objects.all():
     key = s3.Object(bucket.name, obj.key)
     print key.server_side_encryption

and 

 #!/usr/bin/env python
 import boto3

 s3_client = boto3.client('s3')
 head = s3_client.head_object(
     Bucket="<S3 bucket name>",
     Key="<S3 object key>"
 )
 if 'ServerSideEncryption' in head:
     print head['ServerSideEncryption']

Upvotes: 4

Views: 9192

Answers (1)

jarmod
jarmod

Reputation: 78653

It's first worth understanding a few things about S3 and encryption.

  1. When you enable default encryption on an S3 bucket, you're actually configuring a server-side encryption configuration rule on the bucket that will cause S3 to encrypt every object uploaded to the bucket after the rule was configured.
  2. Unrelated to #1, you can apply an S3 bucket policy to a bucket, denying any uploads of objects that are not encrypted. This will prevent you from adding unencrypted data but it will not automatically encrypt anything.
  3. You can encrypt uploads on an object-by-object basis; encryption does not have to be bucket-wide.

So, one way to find out which buckets fall into category #1 (will automatically encrypt anything uploaded to them), you can do this:

import boto3
from botocore.exceptions import ClientError

s3 = boto3.client('s3')

response = s3.list_buckets()

for bucket in response['Buckets']:
  try:
    enc = s3.get_bucket_encryption(Bucket=bucket['Name'])
    rules = enc['ServerSideEncryptionConfiguration']['Rules']
    print('Bucket: %s, Encryption: %s' % (bucket['Name'], rules))
  except ClientError as e:
    if e.response['Error']['Code'] == 'ServerSideEncryptionConfigurationNotFoundError':
      print('Bucket: %s, no server-side encryption' % (bucket['Name']))
    else:
      print("Bucket: %s, unexpected error: %s" % (bucket['Name'], e))

This will result in output like this:

Bucket: mycats, no server-side encryption
Bucket: mydogs, no server-side encryption
Bucket: mytaxreturn, Encryption: [{'ApplyServerSideEncryptionByDefault': {'SSEAlgorithm': 'AES256'}}]

Upvotes: 21

Related Questions