fix(aws): accept aws:kms:dsse as valid S3 server-side encryption - #7634
Open
UTKARSH698 wants to merge 1 commit into
Open
fix(aws): accept aws:kms:dsse as valid S3 server-side encryption#7634UTKARSH698 wants to merge 1 commit into
UTKARSH698 wants to merge 1 commit into
Conversation
DSSE-KMS (dual-layer server-side encryption with AWS KMS keys) reports an SSEAlgorithm of "aws:kms:dsse", which none of the S3 encryption checks recognised, so buckets using the strongest available option were reported as unencrypted.
UTKARSH698
had a problem deploying
to
scan-security
July 31, 2026 11:36 — with 
GitHub Actions
Failure
GitHub Actions
Failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
S3 supports dual-layer server-side encryption with AWS KMS keys (DSSE-KMS), which reports an
SSEAlgorithmofaws:kms:dsse. None of checkov's S3 encryption logic recognises that value, so a bucket using the strongest option AWS offers is currently reported as unencrypted.This adds
aws:kms:dssealongside the existingaws:kms/AES256values everywhere checkov decides whether an S3 bucket is encrypted:checkov/cloudformation/checks/resource/aws/S3Encryption.py(CKV_AWS_19)get_expected_values()checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml(CKV_AWS_19)withinlistscheckov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml(CKV_AWS_145)equals: "aws:kms"→within: ["aws:kms", "aws:kms:dsse"]checkov/{terraform,cloudformation}/graph_builder/graph_components/generic_resource_encryption.pyencryption_attribute mapping so the graph attribute agrees with the checkscheckov/common/graph/graph_builder/graph_components/attribute_names.pyEncryptionTypes.AWS_KMS_DSSE_VALUEconstantDSSE-KMS is KMS-backed, so passing CKV_AWS_145 ("encrypted with KMS by default") is the intended semantics, not a loosening of it.
Tests
tests/cloudformation/checks/resource/aws/test_S3Encryption.py::test_dsse_kms— new test over a newexample_S3EncryptionDsse/template covering DSSE-KMS, SSE-KMS, SSE-S3 (pass) and a near-missaws:kms:dss(fail), so the check is not merely accepting anyaws:kms*prefix. The existingS3Templates/fixture is shared by 8 other test modules, so a separate directory avoids perturbing their counts.server_side_encryption_configurationblock and a separateaws_s3_bucket_server_side_encryption_configurationresource.Verified non-vacuous: with the test/fixture changes applied but the
checkov/source changes reverted, all three tests fail (test_dsse_kms,test_S3BucketEncryption,test_S3KMSEncryptedByDefault).Regression run:
tests/terraform/graph/checks/test_yaml_policies.pyandtests/cloudformation/checks/resource/aws/— 326 passed.flake8andmypyclean on the changed files.Note on prior art
@evan-schiewe proposed the CKV_AWS_19 terraform half of this in #7415 back in January and was closed by the stale bot on 2026-07-25 without ever being reviewed on its merits. This supersedes it and covers the CloudFormation check, CKV_AWS_145, and the graph-builder encryption attribute as well, all of which had the same gap.