Ensure Cloud Object Storage encryption is done with customer managed keys

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Using API/CLI: Use of Server-Side Encryption with Customer-Provided Keys (SSE-C) can be validated by the following steps: Note: Ensure that you have completed the configuration setup to use the CLI by following the guidelines on the Using the AWS CLI page 1. Review the metadata of the object that is encrypted using the customer-provided key. The operation can be performed using an API call or via a command-line interface. Here is an example call to get the object metadata: aws --endpoint https://s3.private.au-syd.cloud-object-storage.appdomain.cloud s3api head-object --bucket <bucket-name> --key <object-name> --sse-customer- algorithm=AES256 --sse-customer-key=<customer-key-used-to encrypt-the-object> 1. The presence of the object headers SSECustomerKeyMD5 and SSECustomerAlgorithm from the API/CLI response should confirm that the object is encrypted using the key.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Using API/CLI: Objects can be uploaded with your own key by using a PUT object request with key specific headers. Please refer to Server-Side Encryption with Customer-Provided Keys for additional information.