Is my S3 bucket HIPAA compliant? The question AWS can't answer

Stave, an open-source command-line tool, evaluates Amazon S3 bucket configurations against a built-in HIPAA profile that maps 28 controls to specific HIPAA Security Rule sections, addressing the recurring r/aws question of whether an encrypted, logged, private bucket is HIPAA compliant. In the example report shown, a bucket named phi-patient-records fails control CONTROLS.001.STRICT under §164.312(a)(2)(iv) because it uses an AWS-managed key rather than a customer-managed key, and fails AUDIT.002 under §164.312(b) because CloudTrail object-level data events are not configured. The tool's author notes AWS signs the Business Associate Agreement and supplies encryption, logging and access controls but will not evaluate whether a customer's specific configuration satisfies the Security Rule, which the shared responsibility model leaves to the customer.

Is my S3 bucket HIPAA compliant? The question AWS can't answer ✓ Human-authored analysis; AI used for formatting and proofreading. Recurring theme on r/aws: "I'm storing PHI in S3. I enabled encryption, turned on logging, set the bucket to private. Are we HIPAA compliant?" The top reply is always some version of: "AWS won't tell you that. You need to evaluate y our configuration against the Security Rule yourself." That reply is correct and does not help. The HIPAA Security Rule doesn't mention S3. It defines four categories of safeguards that apply to any system storing electronic protected health information ePHI : Access Control SS 164.312 a 1 -- Only authorized users can reach PHI Audit Controls SS 164.312 b -- All access to PHI is logged Encryption SS 164.312 a 2 iv , SS 164.312 e 2 ii -- Data encrypted at rest and in transit Retention SS 164.316 b 2 -- PHI retained for minimum 6 years Teams get stuck mapping these to S3 settings. Encryption at rest is one checkbox. But which KMS key type? Is server access logging enough, or do you need CloudTrail object-level events? Does Block Public Access count if it's only set at the account level? Stave is an open-source CLI that evaluates S3 configurations against compliance profiles. The built-in HIPAA profile maps 28 controls to specific Security Rule sections and evaluates them against an observation snapshot of your bucket configuration. stave evaluate --snapshot observations/snap.json --profile hipaa The output is a structured report with pass/fail verdicts, regulatory citations, and remediation steps: ═══ HIPAA Security Rule ═══ Bucket: phi-patient-records Account: 456 Snapshot: 2026-04-08T14:30:00Z Result: FAIL ── CRITICAL ── FAIL CONTROLS.001.STRICT — critical Compliance: §164.312 a 2 iv — CMK required for key revocation during breach response Finding: Encryption uses AWS-managed key — customer cannot revoke Remediation: Change default encryption to SSE-KMS with a customer-managed key PASS CONTROLS.004 — critical Compliance: §164.312 e 2 ii — Transmission Security PASS AUDIT.001 — critical Compliance: §164.312 b — Audit Controls PASS ACCESS.001 — critical Compliance: §164.312 a 1 — Access Control ── HIGH ── FAIL AUDIT.002 — high Compliance: §164.312 b — Object-level logging for PHI access audit trail Finding: CloudTrail object-level data events not configured Remediation: Configure a CloudTrail trail with S3 data event selector Each finding maps directly to a HIPAA citation. Your auditor can trace the control back to the regulation. AWS signs the Business Associate Agreement. AWS provides the encryption toggles, the logging infrastructure, and the access controls. But AWS will never evaluate whether your specific configuration satisfies the Security Rule. That is the customer's responsibility under the shared responsibility model. Stave bridges that gap. Instead of a 47-page checklist, you get a single command that produces a pass/fail verdict with the regulatory receipts to back it up. Key Takeaways - •The HIPAA Security Rule doesn't mention S3. - •This story was reported by Dev.to , covering developments in the dev space. - •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage. 📖 Continue reading the full article: Read Full Article on Dev.to → https://dev.to/bala paranj 059d338e44e7e/is-my-s3-bucket-hipaa-compliant-the-question-aws-cant-answer-ci9