DEV Community

Bala Paranj
Bala Paranj

Posted on

Why encryption-at-rest doesn't protect your S3 bucket

#hipaa #aws #s3 #security

✓ Human-authored analysis; AI used for formatting and proofreading.

"We have SSE enabled on all our S3 buckets. Our security team says we're good on HIPAA encryption. But I noticed the bucket policy allows public read. Does the encryption protect us?"

No. And this misunderstanding is more dangerous than having no encryption at all, because it creates a false sense of compliance.

How S3 server-side encryption works

SSE-S3 (AES-256) and SSE-KMS encrypt objects at rest on disk. The AWS documentation states: encryption is transparent on read. When any principal with s3:GetObject permission calls GetObject, S3 decrypts the object automatically and returns plaintext.

If the bucket policy grants s3:GetObject to Principal: "*", anyone on the internet gets plaintext PHI. The encryption key never enters the picture. SSE protects against AWS datacenter disk theft. A threat model that is already covered by AWS's own physical security controls and BAA.

What Stave detects: COMPOUND.002

Stave's HIPAA profile evaluates encryption and access controls as separate controls, then runs a compound risk detector that catches dangerous combinations.

What happens when a bucket has encryption enabled but public access:

stave evaluate --snapshot observations/snap.json --profile hipaa
Enter fullscreen mode Exit fullscreen mode 
═══ HIPAA Security Rule ═══
Bucket:    phi-records-encrypted
Account:   ***789
Snapshot:  2026-04-08T10:00:00Z
Result:    FAIL

── COMPOUND RISKS ──

  [HIGH] COMPOUND.002 (triggers: ACCESS.001, CONTROLS.001)
  Encryption at rest is configured but the bucket is publicly
  accessible. Encryption provides no confidentiality benefit while
  public access is enabled.

── CRITICAL ──

  [FAIL] ACCESS.001 — critical
  Compliance: §164.312(a)(1) — Access Control
  Finding: Block Public Access not fully enabled
  Remediation: Enable all four Public Access Block settings

── HIGH ──

  [PASS] CONTROLS.001 — high
  Compliance: §164.312(a)(2)(iv) — Encryption and Decryption
Enter fullscreen mode Exit fullscreen mode

Notice that CONTROLS.001 passes. Encryption is on. But the compound detector flags the combination: a passing encryption control alongside a failing access control means encryption is providing zero confidentiality.

Why individual control checklists miss it

Most compliance tools evaluate controls independently. Encryption: check. Each control gets a green checkmark. The problem is that the combination creates a risk that neither control captures alone.

Stave's compound risk detection evaluates known dangerous patterns after individual control evaluation. COMPOUND.002 fires when ACCESS.001 fails and CONTROLS.001 passes simultaneously. The finding is prepended to the report at HIGH severity so it appears before any individual control results.

Encryption at rest is a necessary HIPAA control (SS 164.312(a)(2)(iv)). But it is not sufficient without access control (SS 164.312(a)(1)). If your bucket is publicly readable, SSE is not doing anything useful. S3 decrypts transparently on every GetObject call. Fix access control first. Encryption without access control is security theater.

Top comments (0)