mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 04:51:51 +00:00
chore(aws): enhance metadata for storagegateway service (#9433)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
ab4d7e0c19
commit
352f136a0f
@@ -20,6 +20,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS Secrets Manager service metadata to new format [(#9408)](https://github.com/prowler-cloud/prowler/pull/9408)
|
||||
- Improve SageMaker service tag retrieval with parallel execution [(#9609)](https://github.com/prowler-cloud/prowler/pull/9609)
|
||||
- Update AWS Redshift service metadata to new format [(#9385)](https://github.com/prowler-cloud/prowler/pull/9385)
|
||||
- Update AWS Storage Gateway service metadata to new format [(#9433)](https://github.com/prowler-cloud/prowler/pull/9433)
|
||||
|
||||
---
|
||||
|
||||
|
||||
+28
-15
@@ -1,32 +1,45 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "storagegateway_fileshare_encryption_enabled",
|
||||
"CheckTitle": "Check if AWS StorageGateway File Shares are encrypted with KMS CMK.",
|
||||
"CheckTitle": "Storage Gateway file share is encrypted with KMS CMK",
|
||||
"CheckType": [
|
||||
"Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/SOC 2",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/HIPAA Controls (USA)",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "storagegateway",
|
||||
"SubServiceName": "filegateway",
|
||||
"ResourceIdTemplate": "arn:aws:storagegateway:region:account-id:share",
|
||||
"Severity": "low",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Ensure that Amazon Storage Gateway service is using AWS KMS Customer Master Keys (CMKs) instead of AWS managed-keys (i.e. default keys) for file share data encryption, in order to have a fine-grained control over data-at-rest encryption/decryption process and meet compliance requirements. An AWS Storage Gateway file share is a file system mount point backed by Amazon S3 cloud storage.",
|
||||
"Risk": "This could provide an avenue for unauthorized access to your data by not having fine-grained control over data-at-rest encryption/decryption process and meet compliance requirements.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/filegateway/latest/files3/encrypt-objects-stored-by-file-gateway-in-amazon-s3.html",
|
||||
"Description": "Storage Gateway file shares configured with **customer-managed KMS keys (CMKs)** for server-side encryption of objects written to S3.\n\nFile shares without an explicit KMS key (e.g., `SSE-KMS` or `DSSE-KMS`) are identified.",
|
||||
"Risk": "Without **CMEK**, encryption relies on provider-managed keys, reducing control over who can decrypt and when. This weakens confidentiality by limiting key-policy enforcement, revocation, and auditable key use, increasing exposure from stolen S3 credentials or overly permissive roles.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/StorageGateway/file-shares-encrypted-with-cmk.html#",
|
||||
"https://docs.aws.amazon.com/filegateway/latest/files3/encrypt-objects-stored-by-file-gateway-in-amazon-s3.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws storagegateway update-nfs-file-share --region us-east-1 --file-share-arn arn:aws:storagegateway:us-east-1:123456789012:share/share-abcd1234 --kms-encrypted --kms-key arn:aws:kms:us-east-1:123456789012:key/abcdabcd-1234-1234-1234-abcdabcdabcd",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/StorageGateway/file-shares-encrypted-with-cmk.html#",
|
||||
"Terraform": ""
|
||||
"CLI": "aws storagegateway update-nfs-file-share --file-share-arn <example_resource_arn> --kms-encrypted --kms-key <example_kms_key_arn>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: enable KMS CMK encryption for a Storage Gateway NFS file share\nResources:\n <example_resource_name>:\n Type: AWS::StorageGateway::NFSFileShare\n Properties:\n ClientToken: \"<example_resource_id>\"\n GatewayARN: \"<example_resource_arn>\"\n LocationARN: \"<example_resource_arn>\"\n Role: \"<example_resource_arn>\"\n KMSEncrypted: true # Critical: enables KMS CMK encryption for the file share\n KMSKey: \"<example_kms_key_arn>\" # Critical: CMK ARN used for encryption\n```",
|
||||
"Other": "1. In the AWS Console, go to Storage Gateway > File shares\n2. Select the affected file share and click Edit\n3. Under Encryption, choose AWS KMS key\n4. Select the CMK to use (or paste its ARN)\n5. Save changes",
|
||||
"Terraform": "```hcl\n# Enable KMS CMK encryption for a Storage Gateway NFS file share\nresource \"aws_storagegateway_nfs_file_share\" \"<example_resource_name>\" {\n client_list = [\"<example_cidr_block>\"]\n gateway_arn = \"<example_resource_arn>\"\n location_arn = \"<example_resource_arn>\"\n role_arn = \"<example_resource_arn>\"\n\n kms_encrypted = true # Critical: enables KMS CMK encryption\n kms_key_arn = \"<example_kms_key_arn>\" # Critical: CMK ARN used for encryption\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that Amazon Storage Gateway service is using AWS KMS Customer Master Keys (CMKs).",
|
||||
"Url": "https://docs.aws.amazon.com/filegateway/latest/files3/encrypt-objects-stored-by-file-gateway-in-amazon-s3.html"
|
||||
"Text": "Use a **customer-managed KMS key** for each file share's server-side encryption (`SSE-KMS`; *consider* `DSSE-KMS` for multilayer needs). Apply **least privilege** and **separation of duties** to key access, rotate keys, monitor key usage, and restrict scope to necessary principals and regions.",
|
||||
"Url": "https://hub.prowler.com/check/storagegateway_fileshare_encryption_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"encryption"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+18
-11
@@ -1,32 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "storagegateway_gateway_fault_tolerant",
|
||||
"CheckTitle": "Check if AWS StorageGateway Gateways are hosted in a fault-tolerant environment.",
|
||||
"CheckTitle": "AWS Storage Gateway gateway is not hosted on EC2",
|
||||
"CheckType": [
|
||||
"Resilience"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Denial of Service"
|
||||
],
|
||||
"ServiceName": "storagegateway",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:aws:storagegateway:region:account-id:share",
|
||||
"Severity": "low",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Storage Gateway, when hosted on an EC2 environment, runs on a single EC2 instance. This is a single-point of failure for any applications expecting highly available access to application storage.",
|
||||
"Risk": "Running Storage Gateway as a mechanism for providing file-based application storage that require high-availability increases the risk of application outages if any AZ outages occur.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/filegateway/latest/files3/disaster-recovery-resiliency.html",
|
||||
"Description": "AWS Storage Gateway hosted on an **EC2 instance** is flagged by assessing each gateway's hosting environment, distinguishing **single-instance EC2** deployments from **non-EC2** platforms that can leverage platform-level high availability.",
|
||||
"Risk": "A **single EC2-hosted gateway** concentrates failure risk. Instance or AZ disruption, reboots, or network faults can halt file access, causing downtime and stalled writes. This degrades **availability** and can affect **integrity** via partial operations or cache desynchronization.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/filegateway/latest/files3/resource-vm-setup.html",
|
||||
"https://docs.aws.amazon.com/filegateway/latest/files3/disaster-recovery-resiliency.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Other": "1. In the AWS Console, go to Storage Gateway and click Create gateway\n2. Choose your gateway type, then under Host platform select VMware ESXi, Microsoft Hyper-V, Linux KVM, or Hardware Appliance (do not select Amazon EC2)\n3. Download and deploy the VM on your host, power it on, and note its IP\n4. In the console, connect to and Activate the new gateway\n5. Recreate equivalent resources (shares/volumes/tapes) on the new gateway and update clients to use the new gateway IP/DNS\n6. In Storage Gateway > Gateways, delete the old EC2-hosted gateway\n7. Verify the new gateway's details show Host platform not equal to Amazon EC2",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Migrating workloads to Amazon EFS, FSx, or other storage services can provide higher availability architectures if required.",
|
||||
"Url": "https://docs.aws.amazon.com/filegateway/latest/files3/resource-vm-setup.html"
|
||||
"Text": "Design for **high availability**: avoid single-instance gateways for critical workloads. Prefer managed multi-AZ services like **EFS** or **FSx**, or use multiple gateways with client failover and resilient naming. Apply **defense in depth**, validate failover regularly, and monitor health to prevent outages.",
|
||||
"Url": "https://hub.prowler.com/check/storagegateway_gateway_fault_tolerant"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"resilience"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
Reference in New Issue
Block a user