Example SCPs for Amazon S3 - Amazon Organizations
Prevent Amazon S3 unencrypted object uploads
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Example SCPs for Amazon S3

Note

Amazon Simple Storage Service (Amazon S3) automatically applies server-side encryption (SSE-S3) for each new object, unless you specify a different encryption option. For more information, see Amazon S3 now automatically encrypts all new objects in the Amazon S3 User Guide.

Prevent Amazon S3 unencrypted object uploads

The following policy restricts all users from uploading unencrypted objects to S3 buckets.

{
  "Effect": "Deny",
  "Action": "s3:PutObject",
  "Resource": "*",
  "Condition": {
    "Null": {
      "s3:x-amz-server-side-encryption": "true"
    }
  }
}

The following policy restricts all users from uploading unencrypted objects to S3 buckets and also enforces a specified encryption type (either AES256 or aws:kms) for object upload in their buckets.

[
  {
    "Effect": "Deny",
    "Action": "s3:PutObject",
    "Resource": "*",
    "Condition": {
      "Null": {
        "s3:x-amz-server-side-encryption": "true"
      }
    }
  },
  {
    "Effect": "Deny",
    "Action": "s3:PutObject",
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {
        "s3:x-amz-server-side-encryption": "AES256"
      }
    }
  }
]