# AI-generated S3 encryption fix
# Risk Score: 8.5/10 (High) - Data at rest not encrypted
# Confidence: 94% - Based on 10,000+ similar findings
resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
bucket = aws_s3_bucket.example.id
rule {
apply_server_side_encryption_by_default {
kms_master_key_id = aws_kms_key.example.arn
sse_algorithm = "aws:kms"
}
bucket_key_enabled = true
}
}
# AI Compliance Mapping:
# SOC 2: CC6.1 (Data Protection) - 95% match
# HITRUST: H.01.06 (Encryption) - 92% match
# ISO 27001: A.10.1.1 (Cryptography) - 88% match
# Estimated fix time: 15 minutes# Risk Analysis Dashboard
# Overall Risk Score: 8.5/10 (High)
## Vulnerability Details
- Severity: HIGH
- CVSS Score: 7.8
- Exploitability: Easy
- Impact: Data Breach Risk
## Risk Factors
- Unencrypted data at rest
- No KMS key rotation policy
- Missing bucket versioning
- Public read access potential
## Business Impact
- Financial: $50K - $500K potential loss
- Reputation: High brand damage risk
- Compliance: SOC 2/HITRUST violations
- Legal: GDPR/CCPA penalties possible
## Remediation Priority
1. Enable S3 encryption (Immediate)
2. Implement KMS key rotation (24h)
3. Enable bucket versioning (48h)
4. Review access policies (1 week)
# Compliance Framework Mapping
## SOC 2 Type II
✅ CC6.1 - Data Protection (95% match)
- S3 encryption configuration
- KMS key management
- Access controls
## HITRUST CSF
✅ H.01.06 - Encryption (92% match)
- Data at rest encryption
- Key management procedures
- Cryptographic controls
## ISO 27001
✅ A.10.1.1 - Cryptography (88% match)
- Encryption policy implementation
- Key management lifecycle
- Cryptographic controls
## Additional Mappings
- PCI DSS: 3.4 (Data Protection)
- GDPR: Art. 32 (Security of Processing)
- NIST: SC-28 (Data Protection)
## Evidence Collection
- Screenshots: S3 bucket settings
- Logs: KMS key usage
- Policies: Encryption configuration
- Tests: Encryption verification