DEV Community

Bala Paranj
Bala Paranj

Posted on

Is my S3 bucket HIPAA compliant? The question AWS can't answer

#hipaa #aws #s3 #security

✓ Human-authored analysis; AI used for formatting and proofreading.

Recurring theme on r/aws:

"I'm storing PHI in S3. I enabled encryption, turned on logging, set the bucket to private. Are we HIPAA compliant?"

The top reply is always some version of: "AWS won't tell you that. You need to evaluate your configuration against the Security Rule yourself."

That reply is correct and does not help.

What HIPAA requires for S3

The HIPAA Security Rule doesn't mention S3. It defines four categories of safeguards that apply to any system storing electronic protected health information (ePHI):

  • Access Control (SS 164.312(a)(1)) -- Only authorized users can reach PHI
  • Audit Controls (SS 164.312(b)) -- All access to PHI is logged
  • Encryption (SS 164.312(a)(2)(iv), SS 164.312(e)(2)(ii)) -- Data encrypted at rest and in transit
  • Retention (SS 164.316(b)(2)) -- PHI retained for minimum 6 years

Teams get stuck mapping these to S3 settings. Encryption at rest is one checkbox. But which KMS key type? Is server access logging enough, or do you need CloudTrail object-level events? Does Block Public Access count if it's only set at the account level?

How Stave evaluates HIPAA compliance

Stave is an open-source CLI that evaluates S3 configurations against compliance profiles. The built-in HIPAA profile maps 28 controls to specific Security Rule sections and evaluates them against an observation snapshot of your bucket configuration.

stave evaluate --snapshot observations/snap.json --profile hipaa
Enter fullscreen mode Exit fullscreen mode

The output is a structured report with pass/fail verdicts, regulatory citations, and remediation steps:

═══ HIPAA Security Rule ═══
Bucket:    phi-patient-records
Account:   ***456
Snapshot:  2026-04-08T14:30:00Z
Result:    FAIL

── CRITICAL ──

  [FAIL] CONTROLS.001.STRICT — critical
  Compliance: §164.312(a)(2)(iv) — CMK required for key revocation during breach response
  Finding: Encryption uses AWS-managed key — customer cannot revoke
  Remediation: Change default encryption to SSE-KMS with a customer-managed key

  [PASS] CONTROLS.004 — critical
  Compliance: §164.312(e)(2)(ii) — Transmission Security

  [PASS] AUDIT.001 — critical
  Compliance: §164.312(b) — Audit Controls

  [PASS] ACCESS.001 — critical
  Compliance: §164.312(a)(1) — Access Control

── HIGH ──

  [FAIL] AUDIT.002 — high
  Compliance: §164.312(b) — Object-level logging for PHI access audit trail
  Finding: CloudTrail object-level data events not configured
  Remediation: Configure a CloudTrail trail with S3 data event selector
Enter fullscreen mode Exit fullscreen mode

Each finding maps directly to a HIPAA citation. Your auditor can trace the control back to the regulation.

AWS signs the Business Associate Agreement. AWS provides the encryption toggles, the logging infrastructure, and the access controls. But AWS will never evaluate whether your specific configuration satisfies the Security Rule. That is the customer's responsibility under the shared responsibility model.

Stave bridges that gap. Instead of a 47-page checklist, you get a single command that produces a pass/fail verdict with the regulatory receipts to back it up.

Top comments (0)