S3 general purpose buckets should be encrypted at rest with AWS KMS keys

How to fix it

Set the bucket's default encryption to an AWS KMS key, and enable the S3 bucket key at the same time to cut KMS request costs. This applies to new objects only; existing objects keep the encryption they were written with. Every principal that reads or writes objects now needs kms:Decrypt and kms:GenerateDataKey on the key, so grant that before switching.

In the console

S3 → the bucket → Properties → Default encryption

With the AWS CLI

aws s3api put-bucket-encryption --bucket <bucket-name> --server-side-encryption-configuration file://encryption.json

With Terraform

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = var.bucket_name

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = var.kms_key_arn
    }

    bucket_key_enabled = true
  }
}