6WAF

S3 bucket uses SSE-KMS without Bucket Key

LOW

What's the problem

Every object read/write makes S3 call KMS: extra KMS request charges and risk of hitting the KMS quota. Bucket Key cuts calls by up to 99%; the real saving depends on request volume, so 6WAF does not estimate it

How 6WAF detects it

  • Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
  • Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
  • Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.

Pillar: Security — Fast Scan

Group: Data protection (S3, EBS, KMS, snapshots, AMIs)

Reference standard: 6WAF classification — no Security Hub/CIS control

Get the 39-point AWS waste checklist by email (free, self-serve)

Unticked: we only send the checklist and delete the email after 90 days. Privacy policy

Scan this check (and the other 91) automatically in ~10 minutes

Start free

Related checks

S3 bucket Public Access Block missing or incompleteS3 account-level Public Access Block not fully enabledS3 bucket uses SSE-S3 (informational)S3 bucket has no explicit encryption configuration