Enforcing Default Encryption Everywhere
Require encryption so unprotected data can never be stored.
Enforcing Default Encryption Everywhere is a free AWS Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Defaults Matter
Relying on people to remember to enable encryption guarantees gaps. The robust approach is to make encryption the default and block anything unencrypted.
This shifts from hoping for compliance to enforcing it structurally across the account.
S3 Default Encryption
Every S3 bucket now applies default encryption; objects are encrypted server-side even if the uploader does not ask.
You can set the default to SSE-KMS with a specific key, so all new objects are protected and auditable without per-upload effort.
Denying Unencrypted Uploads
To go further, a bucket policy can deny any PutObject that does not request the required encryption.
This rejects writes that try to bypass encryption, ensuring nothing lands unprotected. It is a common pattern for sensitive buckets.
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::secure-bucket/*",
"Condition": { "StringNotEquals": { "s3:x-amz-server-side-encryption": "aws:kms" } }
}EBS Encryption by Default
You can enable EBS encryption by default per region.
Once on, every new EBS volume and snapshot in that region is encrypted automatically with your chosen KMS key. This closes the gap of accidentally launching unencrypted volumes.
Enforcing with SCPs
Service Control Policies (SCPs) enforce encryption across an entire organization.
An SCP can deny actions like creating an unencrypted RDS instance or volume in any member account. Because SCPs cap permissions, no one, not even an admin, can bypass them.
Detecting Non-Compliance with Config
AWS Config rules continuously check whether resources are encrypted.
- Rules flag unencrypted volumes, buckets, and databases.
- Paired with auto-remediation, they can fix or report drift automatically.
This provides ongoing assurance beyond point-in-time settings.
Requiring a Specific Key
Defaults can require not just "any encryption" but a specific KMS key.
Policies use conditions to demand a particular key ARN, ensuring data is encrypted under a key your team controls and audits, rather than a default AWS managed key.
Preventive vs Detective Together
The strongest posture combines both:
- Preventive controls (SCPs, bucket policies, default settings) stop unencrypted resources from being created.
- Detective controls (Config, Security Hub) catch anything that slips through.
Defense in depth applies to encryption too.
Encryption in CI/CD
Shift enforcement left by checking infrastructure-as-code templates before deployment.
Tools and custom policy checks verify that CloudFormation or Terraform sets encryption, so non-compliant resources are blocked at the pipeline rather than in production.
Enforcing TLS Alongside At-Rest
Default encryption usually means at rest, but you should also enforce encryption in transit.
An S3 bucket policy using the aws:SecureTransport condition denies any request not made over TLS. Pairing this with default at-rest encryption ensures data is protected both where it sits and while it moves.
Putting Enforcement Together
A complete strategy: turn on default encryption for S3 and EBS, deny unencrypted creation with SCPs and bucket policies, and verify with Config and Security Hub.
Encryption becomes guaranteed rather than optional.
Quick Check
Pick the strongest enforcement.
Recap
You learned to enforce default encryption.
- Default encryption on S3 and EBS makes protection automatic.
- SCPs and bucket policies deny unencrypted creation organization-wide.
- Config and Security Hub detect anything that slips through.
Frequently asked questions
Is the “Enforcing Default Encryption Everywhere” lesson free?
Yes — the full text of “Enforcing Default Encryption Everywhere” is free to read here on the web, and the AWS Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Enforcing Default Encryption Everywhere”?
Require encryption so unprotected data can never be stored. You practise AWS Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start AWS Security Academy?
No prior experience is required. AWS Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Enforcing Default Encryption Everywhere” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this AWS Security Academy lesson?
Yes. Every AWS Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Encrypting S3, EBS, and RDS at Rest
- Enforcing Default Encryption Everywhere
- TLS Certificates with AWS Certificate Manager
- Storing Credentials in Secrets Manager