Universally apply restriction to bucket policy, for all S3 buckets

Solution 1:

Use an AWS Service Control Policy, attached to your AWS Organisation OUs. The snippet below only enforces S3 encryption in transit, but you can also enforce:

• S3 / EBS / RDS encryption at rest (probably other services too)
• Allowed EC2 sizes / families
• Creation of default VPCs
• Disabling default EBS encryption
• Deactivation of security services
• Root user doing much (they shouldn't do anything, really)
• Region enforcement
• Whitelist services for the OU

I might not have the brackets quite right, I cut this out of a larger SCP, but any IDE like VSCode can help with that.

{
  "Version": "2012-10-17",
  "Statement": [{
        "Sid": "S3EncryptionInTransit",
        "Effect": "Deny",
        "Action": "s3:PutObject",
        "Resource": "*",
        "Condition": {
          "ForAllValues:StringNotEquals": {
            "s3:x-amz-server-side-encryption": ["AES256", "aws:kms"]
          }
        }
    }]
}