feat(s3): add blockedEncryptionTypes field to s3.Bucket by ysthakur · Pull Request #37047 · aws/aws-cdk

ysthakur · 2026-02-21T01:23:22Z

Issue

Reason for this change

S3 recently added a new BlockedEncryptionTypes field to server-side encryption rules (docs). This field allows users to explicitly block or unblock SSE-C encryption on their bucket.

Users should be able to set this field through CDK. This will become especially important when SSE-C starts being blocked by default in April (blog post).

Description of changes

Added a blockedEncryptionTypes field to the L2 s3.Bucket construct.

If blockedEncryptionTypes is not set, behavior is same as before. No default blockedEncryptionTypes value will be chosen (this is important, we want to let S3 choose what default to apply).
If blockedEncryptionTypes is set and encryptionType is BucketEncryption.UNENCRYPTED, a server-side encryption configuration will be added with just blockedEncryptionTypes
- This happens even if bucketKeyEnabled is explicitly set. Please confirm that this is behavior you want. I went with it because bucketKeyEnabled is already ignored when encryptionType is BucketEncryption.UNENCRYPTED.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Ran unit tests, added integ tests.

Verified that the MySsecBlockedBucket bucket has SSE-C blocked (and no default server-side encryption type explicitly set)
Verified that the MyKmsBucket bucket has no encryption types blocked

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

ysthakur · 2026-02-21T01:25:21Z

packages/aws-cdk-lib/aws-s3/lib/bucket.ts

+   * Encryption types that should be blocked for this bucket. Use `NONE` to allow all
+   * encryption types.
+   *
+   * @default - Amazon S3 determines which encryption types to block.


Yes, this isn't a particularly helpful comment, but I wrote this because the default is going to change soon. Right now, no encryption types are blocked by default, but in April, SSE-C will start being blocked by default. When that happens, we can update this to say @default - SSE-C is blocked by default.

An alternative is to say @default - no encryption types are blocked, but SSE-C will start being blocked in April 2026, but putting times in doc comments feels wrong.

Is there any documentation for this at the moment? Like a link we can add here so the users can see which types will be blocked by default by S3? IF there is, you could add a

@see <LINK TO OFFICIAL DOC>

ysthakur · 2026-02-21T02:21:22Z

Any idea why the PR Linter workflow is failing with "Bad credentials"?

github-actions · 2026-02-21T05:37:02Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	24 ran	24 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2026-02-21T05:37:04Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	24 ran	24 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

aws-cdk-automation

(This review is outdated)

packages/aws-cdk-lib/aws-s3/lib/bucket.ts

packages/aws-cdk-lib/aws-s3/test/bucket.test.ts

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

packages/aws-cdk-lib/aws-s3/test/bucket.test.ts

nikhil1699

LGTM !

Pull request has been modified.

mergify · 2026-03-19T11:29:28Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-03-19T11:30:16Z

Merge Queue Status

✅ Entered queue — 2026-03-19 11:29 UTC · Rule: default-squash
✅ Checks started · in-place · dashboard
🟠 Running checks
⏳ Merge · ETA: 2026-03-19 16:34 UTC 🚀

Required conditions to merge

Required conditions to stay in the queue

mergify · 2026-03-19T17:38:43Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2026-03-19T17:39:04Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

feat(aws-s3): Add blockedEncryptionTypes field to s3.Bucket

6e8d9f6

github-actions bot added beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 labels Feb 21, 2026

ysthakur commented Feb 21, 2026

View reviewed changes

Merge branch 'main' into blocked-encryption-types

d8be7bb

ysthakur marked this pull request as draft February 21, 2026 01:31

Forgot to push changes

e0c9d31

ysthakur marked this pull request as ready for review February 21, 2026 01:38

pahud mentioned this pull request Feb 21, 2026

CI Pending Approval - 45 PR(s) pahud/aws-cdk#11

Open

Merge branch 'main' into blocked-encryption-types

3cd28f2

aws-cdk-automation previously requested changes Feb 23, 2026

View reviewed changes

trevormgoodell reviewed Feb 23, 2026

View reviewed changes

packages/aws-cdk-lib/aws-s3/lib/bucket.ts Show resolved Hide resolved

trevormgoodell reviewed Feb 23, 2026

View reviewed changes

packages/aws-cdk-lib/aws-s3/test/bucket.test.ts Show resolved Hide resolved

ysthakur changed the title ~~feat(aws-s3): Add blockedEncryptionTypes field to s3.Bucket~~ feat(s3): add blockedEncryptionTypes field to s3.Bucket Feb 23, 2026

nikhil1699 reviewed Feb 23, 2026

View reviewed changes

packages/aws-cdk-lib/aws-s3/test/bucket.test.ts Show resolved Hide resolved

ysthakur and others added 3 commits February 24, 2026 18:01

Merge branch 'main' into blocked-encryption-types

9d469a3

Specify blockedEncryptionTypes requirements

9c82d21

Merge branch 'main' into blocked-encryption-types

ce01243

nikhil1699 approved these changes Feb 26, 2026

View reviewed changes

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 2, 2026

Allow referring to new BlockedEncryptionTypes not known to CDK yet

db09c4b

ysthakur temporarily deployed to automation March 5, 2026 23:47 — with GitHub Actions Inactive

Merge branch 'main' into blocked-encryption-types

e96842c

Merge branch 'main' into blocked-encryption-types

4ce39df

ysthakur temporarily deployed to automation March 18, 2026 17:44 — with GitHub Actions Inactive

Add error codes to ValidationErrors

05bb3d3

ysthakur temporarily deployed to automation March 18, 2026 18:33 — with GitHub Actions Inactive

Merge branch 'main' into blocked-encryption-types

1bb1f6f

alvazjor temporarily deployed to automation March 19, 2026 10:07 — with GitHub Actions Inactive

alvazjor added the pr/needs-integration-tests-deployment Requires the PR to deploy the integration test snapshots. label Mar 19, 2026

alvazjor temporarily deployed to automation March 19, 2026 10:08 — with GitHub Actions Inactive

alvazjor temporarily deployed to deployment-integ-test March 19, 2026 10:08 — with GitHub Actions Inactive

alvazjor temporarily deployed to automation March 19, 2026 10:08 — with GitHub Actions Inactive

alvazjor approved these changes Mar 19, 2026

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 19, 2026

aws-cdk-automation temporarily deployed to automation March 19, 2026 10:42 — with GitHub Actions Inactive

Merge branch 'main' into blocked-encryption-types

a273817

mergify bot requested a deployment to deployment-integ-test March 19, 2026 16:04 Waiting

mergify bot temporarily deployed to automation March 19, 2026 16:04 Inactive

alvazjor removed the pr/needs-integration-tests-deployment Requires the PR to deploy the integration test snapshots. label Mar 19, 2026

alvazjor temporarily deployed to automation March 19, 2026 16:54 — with GitHub Actions Inactive

mergify bot merged commit 262e8a7 into aws:main Mar 19, 2026
28 of 30 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Mar 19, 2026

ysthakur deleted the blocked-encryption-types branch March 23, 2026 01:39

Conversation

ysthakur commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

ysthakur Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

alvazjor Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

ysthakur commented Feb 21, 2026

Uh oh!

github-actions bot commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nikhil1699 left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Mar 19, 2026

Uh oh!

mergify bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

mergify bot commented Mar 19, 2026

Uh oh!

Uh oh!

github-actions bot commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ysthakur commented Feb 21, 2026 •

edited

Loading

github-actions bot commented Feb 21, 2026 •

edited

Loading

github-actions bot commented Feb 21, 2026 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

mergify bot commented Mar 19, 2026 •

edited

Loading