Ravi Sir's Cards › AWS
Enforce SSE-KMS uploads
This revision card explains Enforce SSE-KMS uploads. It starts from the need that unencrypted uploads create compliance debt instantly. It describes deny PutObject unless s3 — x-amz-server-side-encryption is aws:kms (optionally specific key). The how-to section notes default encryption + Deny-without-header , then CLI --sse aws:kms allow , then plain put deny. An example on the card is kenji Watanabe hospital imaging bucket rejects SSE-S3-only uploads.
Read card text
What this card says
Why do we need it?
Unencrypted uploads create compliance debt instantly.
What is it?
Deny PutObject unless s3:x-amz-server-side-encryption is aws:kms (optionally specific key).
SSE-KMS
How to do it
Default encryption + Deny-without-header → CLI --sse aws:kms allow → plain put deny.
Example
Kenji Watanabe hospital imaging bucket rejects SSE-S3-only uploads.