# S3：防止上传 Amazon S3 未加密对象

### 防止上传 Amazon S3 未加密对象 <a href="#example-s3-1" id="example-s3-1"></a>

以下策略限制所有用户将未加密的对象上传到 S3 存储桶。

```
{
  "Effect": "Deny",
  "Action": "s3:PutObject",
  "Resource": "*",
  "Condition": {
    "Null": {
      "s3:x-amz-server-side-encryption": "true"
    }
  }
}
```

以下策略限制所有用户将未加密的对象上传到 S3 存储桶，并且对其存储桶中的对象上传强制执行指定的加密类型（AES256 或 aws:kms）。

```
[
  {
    "Effect": "Deny",
    "Action": "s3:PutObject",
    "Resource": "*",
    "Condition": {
      "Null": {
        "s3:x-amz-server-side-encryption": "true"
      }
    }
  },
  {
    "Effect": "Deny",
    "Action": "s3:PutObject",
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {
        "s3:x-amz-server-side-encryption": "AES256"
      }
    }
  }
]
```

参考资料

[防止上传 Amazon S3 未加密对象](https://docs.aws.amazon.com/zh_cn/organizations/latest/userguide/orgs_manage_policies_scps_examples_s3.html)
