---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# CAL - AWS S3 Get Encryption subflow

# CAL - AWS S3 Get Encryption subflow {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Subflow that returns the default encryption configuration for an Amazon Web Services (AWS) S3 bucket.

## Roles and availability {#cal-aws-s3-get-encryption__section_q3b_ttk_gtb}

Subscription requirements
:   To use this subflow in custom flows, you must obtain an Integration Hub Enterprise subscription or an App Engine subscription. For more information, see [Request Integration Hub](https://www.servicenow.com/docs/access?context=request-ih-overview&version=yokohama&pubname=yokohama-integrate-applications&ft:locale=en-US).

Role requirements
:   This subflow requires roles granted by delegated development or assigned to
    the user. For more information, see [User access to Flow
    Designer](https://www.servicenow.com/docs/access?context=user-access-flow-designer&version=yokohama&pubname=yokohama-build-workflows&ft:locale=en-US).

## Cloud permission {#cal-aws-s3-get-encryption__section_pk3_lxr_jtb}

To execute this subflow, the caller must have the
s3:GetEncryptionConfiguration cloud permission.

## Inputs {#cal-aws-s3-get-encryption__section-inputs}

Provide a value for each input that your subflow needs. To add
dynamic values, you can also select data pills using the pill picker.{#cal-aws-s3-get-encryption__inputs-description}

Bucket Name
:   Data type: String

    Name of the AWS S3 bucket.

Credential Alias
:   Data type: String

    Credential alias for the
    AWS credential.

Use Mid
:   Data type: True/False

    Selection to indicate whether to
    use a MID Server to make the outbound
    calls.

MID Server
:   Data type: Record

    MID Server for
    making the outbound calls.

## Outputs {#cal-aws-s3-get-encryption__section-outputs}

You can use these outputs as inputs for other
subflows.{#cal-aws-s3-get-encryption__outputs-description}

Is Access Denied
    : Data type: True/False  
    Server authorization status of the call.

    * True: The server has authorized the call
    * False: The server didn't authorize the call
    {#cal-aws-s3-get-encryption__ul_p2l_lmr_2tb}

Is Encrypted
:   Data type: True/False

    Encryption status of the AWS resource.

Bucket Region
:   Data type: String

    Datacenter of the AWS S3 bucket.

KMS Masterkey Id
:   Data type: String

    Customer AWS
    Key Management Service (KMS) key ID used for the default encryption.

Encryption Algorithm
:   Data type: String

    Server-side encryption algorithm used for
    the default encryption.

Bucket Key Enabled
:   Data type: String

    Specifies whether Amazon S3
    uses an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects
    in the bucket.

Error Code
:   Data type: String

    Client error code returned for
    the failed call.