> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/s3-encryption-and-logging-and-secure-transport.md).

# S3 Encryption & Logging & Secure Transport

## S3 Default Encryption

* **S3 default encryption provides a way to set the default encryption behaviour for a S3 bucket** and you can **set it up on a bucket so that all objects are encrypted when they are stored** in the bucket.<br>
* The **objects are encrypted using server-side encryption with either S3-managed keys (SSE-S3) or KMS CMKs**.<br>
* **Default encryption works with all existing and new S3 buckets**.<br>
* **Without default encryption, you must include encryption information to encrypt all objects stored in a bucket with every object storage request** and you must also **set up an S3 bucket policy to reject storage requests that don't include encryption information**.

## CloudTrail Logging for S3 Actions

* You can also **get CloudTrail logs for object-level S3 actions**.

* To do this, **specify the S3 object for your trail** and **when an object-level action occurs in your account, CloudTrail evaluates your trail settings**.

* If the **event matches the object that you specified in a trail, the event is logged**.<br>

* CloudTrail **supports logging S3 object-level API operations such as `GetObject`, `DeleteObject`, and `PutObject`** and **these events are called data events**.

* **By default, CloudTrail trails don't log data events**, but you **can configure trails to log data events for S3 buckets that you specify**, or to **log data events for all the S3 buckets in your AWS account**.

## **`aws:SecureTransport`**

* To **determine HTTP or HTTPS requests** in a bucket policy, use a condition that checks fo&#x72;**`aws:SecureTransport`**.
  * When this key is **true, this means that the request is sent through HTTPS**.

  * To be sure to **comply with the `s3-bucket-ssl-requests-only` Config rule**, create a bucket policy that explicitly **denies access when the request meets the condition `aws:SecureTransport":"false"`** and this policy **explicitly denies access to HTTP requests**.