AWS S3 Object Encryption with SSE-C or Vulnerable Signature Versions

Lacey Cochrane@NullVectorX

•updated Jan 6, 2026•10•5•123

This rule detects Amazon S3 PutObject events where server-side encryption is performed using SSE-C (Server-Side Encryption with Customer-Provided Keys) or where the request uses Signature Version 2 (SigV2). SSE-C relies on the customer to manage encryption keys, which can introduce risks if not handled securely. SigV2 is an older, less secure authentication protocol for AWS requests and its use is generally discouraged in favor of SigV4.