AWS Organization SCP策略对S3存储桶加密管控不生效问题咨询

算力阿峰

2026-10-5

SCP未拦截S3桶禁用加密操作的根因与解决方案

根因说明

你当前SCP仅拦截了s3:DeleteBucketEncryption操作，但AWS环境中禁用S3桶加密的核心操作调用的是s3:PutEncryptionConfiguration接口：通过传入空的加密配置参数覆盖原有规则，全程不会触发s3:DeleteBucketEncryption动作，因此现有规则完全无法匹配拦截目标操作。
s3:DeleteBucketEncryption仅在极少数特定场景下才会被调用，绝大多数常规禁用加密操作都不会使用该接口。

修正后SCP配置

以下配置可实现需求：允许新建桶时首次设置加密、允许修改加密规则（如更换KMS密钥），但禁止任何移除/禁用桶加密的操作，同时保留AWS Control Tower执行角色的豁免权限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BlockS3EncryptionRemoval",
      "Effect": "Deny",
      "Action": "s3:PutEncryptionConfiguration",
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalARN": "arn:aws:iam::*:role/AWSControlTowerExecution"
        },
        "Null": {
          "s3:x-amz-server-side-encryption-configuration": "true"
        }
      }
    },
    {
      "Sid": "BlockDeleteBucketEncryption",
      "Effect": "Deny",
      "Action": "s3:DeleteBucketEncryption",
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalARN": "arn:aws:iam::*:role/AWSControlTowerExecution"
        }
      }
    }
  ]
}