🧾 JSONhard

2. Require KMS encryption on upload

Write an S3 bucket policy statement that DENIES an upload unless it is encrypted with SSE-KMS: • Effect: "Deny" • Principal: "*" • Action: "s3:PutObject" • Resource: "arn:aws:s3:::secure-bucket/*" • Condition: StringNotEquals on "s3:x-amz-server-side-encryption" = "aws:kms"

How to approach this

Encryption AT REST is enforced at write time: deny `s3:PutObject` when the request header `s3:x-amz-server-side-encryption` is NOT `aws:kms`. Because it's Deny + StringNotEquals, any upload that omits KMS encryption (or uses a weaker option) is rejected — so nothing lands unencrypted. Pair this with the TLS-deny policy to cover data in transit and at rest.

config.json