Preventing unintended encryption of Amazon S3 objects

AWS has identified an increase in unauthorized encryption activities targeting Amazon S3 buckets using server-side encryption with customer-provided keys (SSE-C). Malicious actors with valid credentials are re-encrypting customer data, potentially compromising data integrity.

• AWS recommends four security best practices to mitigate risks:
• Block SSE-C encryption if not required by applications
• Implement data recovery procedures like S3 versioning and backups
• Monitor AWS resources for unexpected access patterns
• Use short-term credentials instead of long-term credentials

AWS has implemented automatic mitigations to prevent unauthorized encryption, but recommends customers actively protect their S3 resources through proactive security measures.