mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 21:11:53 +00:00
chore(aws): enhance metadata for s3 service (#9552)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
858446c740
commit
8d78831d29
@@ -37,6 +37,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS OpenSearch service metadata to new format [(#9383)](https://github.com/prowler-cloud/prowler/pull/9383)
|
||||
- Update AWS VPC service metadata to new format [(#9479)](https://github.com/prowler-cloud/prowler/pull/9479)
|
||||
- Update AWS Transfer service metadata to new format [(#9434)](https://github.com/prowler-cloud/prowler/pull/9434)
|
||||
- Update AWS S3 service metadata to new format [(#9552)](https://github.com/prowler-cloud/prowler/pull/9552)
|
||||
|
||||
---
|
||||
|
||||
|
||||
+22
-12
@@ -1,32 +1,42 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_access_point_public_access_block",
|
||||
"CheckTitle": "Block Public Access Settings enabled on Access Points.",
|
||||
"CheckTitle": "S3 access point has all Block Public Access settings enabled",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsS3AccessPoint",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Ensures that public access is blocked on S3 Access Points.",
|
||||
"Risk": "Leaving S3 access points open to the public in AWS can lead to data exposure, breaches, compliance violations, unauthorized access, and data integrity issues.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html#access-points-policies",
|
||||
"Description": "**Amazon S3 access points** have **Block Public Access** configured with all settings enabled: `block_public_acls`, `ignore_public_acls`, `block_public_policy`, and `restrict_public_buckets`.\n\nThe evaluation inspects each access point's public access block configuration.",
|
||||
"Risk": "Without block public access on an access point, ACLs or policies can expose objects publicly despite intended restrictions. This enables unauthorized reads (**confidentiality** loss), writes or deletions (**integrity/availability** impact), and supports bulk data exfiltration or destructive actions.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/s3-access-point-public-access-blocks.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html#access-points-policies",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-19"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-19",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: S3 Access Point with all Block Public Access settings enabled\nResources:\n <example_resource_name>:\n Type: AWS::S3::AccessPoint\n Properties:\n Bucket: <example_bucket_name>\n PublicAccessBlockConfiguration:\n BlockPublicAcls: true # Critical: block public ACLs\n IgnorePublicAcls: true # Critical: ignore any public ACLs\n BlockPublicPolicy: true # Critical: block public policies\n RestrictPublicBuckets: true # Critical: restrict public buckets\n```",
|
||||
"Other": "1. In the AWS console, go to S3 > Access points\n2. Select the noncompliant access point and click Delete access point\n3. Click Create access point, select the same bucket\n4. Ensure Block public access is enabled (all options On by default)\n5. Click Create access point",
|
||||
"Terraform": "```hcl\n# Terraform: S3 Access Point with all Block Public Access settings enabled\nresource \"aws_s3_access_point\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n bucket = \"<example_bucket_name>\"\n\n public_access_block_configuration {\n block_public_acls = true # Critical: block public ACLs\n ignore_public_acls = true # Critical: ignore any public ACLs\n block_public_policy = true # Critical: block public policies\n restrict_public_buckets = true # Critical: restrict public buckets\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure S3 access points are private by default, applying strict access controls, and regularly auditing permissions to prevent unauthorized public access.",
|
||||
"Url": "https://docs.aws.amazon.com/config/latest/developerguide/s3-access-point-public-access-blocks.html"
|
||||
"Text": "Enable all access-point Block Public Access settings (`block_public_acls`, `ignore_public_acls`, `block_public_policy`, `restrict_public_buckets`).\n\nApply **least privilege**, prefer **VPC-only** access points, and layer account and bucket blocks for **defense in depth**. Regularly audit for public principals like `Principal: *`.",
|
||||
"Url": "https://hub.prowler.com/check/s3_access_point_public_access_block"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+20
-12
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_account_level_public_access_blocks",
|
||||
"CheckTitle": "Check S3 Account Level Public Access Block.",
|
||||
"CheckTitle": "S3 account-level Block Public Access ignores public ACLs and restricts public buckets",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsS3AccountPublicAccessBlock",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check S3 Account Level Public Access Block.",
|
||||
"Risk": "Public access policies may be applied to sensitive data buckets.",
|
||||
"Description": "**Amazon S3** account-level **Block Public Access** is assessed for `ignore_public_acls` and `restrict_public_buckets` to confirm centralized blocking of ACL-based public access and limiting buckets with public policies to in-account principals.",
|
||||
"Risk": "Absent these settings, **public ACLs** and broad bucket policies may grant internet or cross-account access. This risks:\n- Confidentiality: bulk data exfiltration\n- Integrity: object overwrite/tampering\n- Availability: malicious deletions or malware hosting, triggering takedowns",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3control put-public-access-block --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --account-id <account_id>",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/s3-policies/bc_aws_s3_21#cloudformation",
|
||||
"Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/s3/s3control/block-public-access",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/s3-policies/bc_aws_s3_21#terraform"
|
||||
"CLI": "aws s3control put-public-access-block --account-id <account_id> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable required S3 Account-level Block Public Access settings\nResources:\n <example_resource_name>:\n Type: AWS::S3::AccountPublicAccessBlock\n Properties:\n AccountId: !Ref AWS::AccountId\n IgnorePublicAcls: true # Critical: Ignores any public ACLs at the account level\n RestrictPublicBuckets: true # Critical: Restricts buckets with public policies to only same-account principals\n```",
|
||||
"Other": "1. In the AWS Console, go to S3\n2. Click Block public access (account settings)\n3. Click Edit\n4. Turn on: Ignore public ACLs and Restrict public buckets\n5. Click Save changes",
|
||||
"Terraform": "```hcl\n# Terraform: Enable required S3 Account-level Block Public Access settings\nresource \"aws_s3_account_public_access_block\" \"<example_resource_name>\" {\n ignore_public_acls = true # Critical: Ignores any public ACLs account-wide\n restrict_public_buckets = true # Critical: Restricts buckets with public policies to same-account principals\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "You can enable Public Access Block at the account level to prevent the exposure of your data stored in S3.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
"Text": "Turn on account-level **Block Public Access** (prefer enabling all four: `block_public_acls`, `ignore_public_acls`, `block_public_policy`, `restrict_public_buckets`) to enforce least privilege. For legitimate access, use private buckets with **CloudFront**, VPC endpoints, or presigned URLs. Regularly review policies with IAM Access Analyzer.",
|
||||
"Url": "https://hub.prowler.com/check/s3_account_level_public_access_blocks"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+20
-12
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_acl_prohibited",
|
||||
"CheckTitle": "Check if S3 buckets have ACLs enabled",
|
||||
"CheckTitle": "S3 bucket has bucket ACLs disabled",
|
||||
"CheckType": [
|
||||
"Logging and Monitoring"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have ACLs enabled",
|
||||
"Risk": "S3 ACLs are a legacy access control mechanism that predates IAM. IAM and bucket policies are currently the preferred methods.",
|
||||
"Description": "**Amazon S3 buckets** are evaluated for **Object Ownership** set to `BucketOwnerEnforced`, which disables bucket and object ACLs. Buckets using any other ownership setting indicate that ACLs remain enabled.",
|
||||
"Risk": "With **ACLs enabled**, access can bypass centralized policy controls, impacting confidentiality and integrity.\n- Unintended public or cross-account reads/writes\n- Object-writer ownership blocking bucket-owner governance\n- Per-object grants hinder auditing, enabling data exfiltration or tampering",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/ensure-object-ownership.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3api put-bucket-ownership-controls --bucket <bucket-name> --ownership-controls Rules=[{ObjectOwnership=BucketOwnerEnforced}]",
|
||||
"NativeIaC": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-ownershipcontrols.html",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws s3api put-bucket-ownership-controls --bucket <bucket-name> --ownership-controls \"Rules=[{ObjectOwnership=BucketOwnerEnforced}]\"",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Disable ACLs by enforcing bucket owner for all objects\nResources:\n <example_resource_name>OwnershipControls:\n Type: AWS::S3::BucketOwnershipControls\n Properties:\n Bucket: <example_resource_name>\n OwnershipControls:\n Rules:\n - ObjectOwnership: BucketOwnerEnforced # Critical: Disables ACLs and makes bucket owner the object owner\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 > Buckets and select the target bucket\n2. Open the Permissions tab\n3. In Object Ownership, click Edit\n4. Select Bucket owner enforced (ACLs disabled)\n5. Click Save changes",
|
||||
"Terraform": "```hcl\n# Disable ACLs by enforcing bucket owner for all objects\nresource \"aws_s3_bucket_ownership_controls\" \"<example_resource_name>\" {\n bucket = \"<example_resource_id>\"\n rule {\n object_ownership = \"BucketOwnerEnforced\" # Critical: Disables ACLs and enforces bucket owner\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that S3 ACLs are disabled (BucketOwnerEnforced). Use IAM policies and bucket policies to manage access.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html"
|
||||
"Text": "Disable ACLs by setting **Object Ownership** to `BucketOwnerEnforced` and manage access with **IAM** and **bucket policies** under **least privilege**. Centralize authorization, review policies regularly, and use organizational guardrails to prevent re-enabling ACLs. *Migrate ACL-based grants into policies before the change.*",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_acl_prohibited"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"identity-access"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+22
-12
@@ -1,32 +1,42 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_cross_account_access",
|
||||
"CheckTitle": "Ensure that general-purpose bucket policies restrict access to other AWS accounts.",
|
||||
"CheckTitle": "S3 bucket policy does not allow cross-account access",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "This check verifies that S3 bucket policies are configured in a way that limits access to the intended AWS accounts only, preventing unauthorized access by external or unintended accounts.",
|
||||
"Risk": "Allowing other AWS accounts to perform sensitive actions (e.g., modifying bucket policies, ACLs, or encryption settings) on your S3 buckets can lead to data exposure, unauthorized access, or misconfigurations, increasing the risk of insider threats or attacks.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html",
|
||||
"Description": "**Amazon S3 bucket policies** are analyzed for statements that grant **cross-account access**.\n\nAny policy that names principals outside the owning account (other account IDs or `Principal: \"*\"`) is treated as cross-account; absence of a policy implies no cross-account grants.",
|
||||
"Risk": "Cross-account grants can let external principals read, write, or administer the bucket, impacting:\n- Confidentiality: unauthorized object access/exfiltration\n- Integrity: object tampering, policy or encryption changes\n- Availability: deletions, versioning changes, or lockouts causing data loss and downtime",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-6",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-6",
|
||||
"Terraform": ""
|
||||
"CLI": "aws s3api delete-bucket-policy --bucket <example_resource_name>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict bucket policy to this AWS account only\nResources:\n <example_resource_name>BucketPolicy:\n Type: AWS::S3::BucketPolicy\n Properties:\n Bucket: <example_resource_name>\n PolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Principal:\n AWS: !Sub arn:aws:iam::${AWS::AccountId}:root # Critical: limits access to the bucket owner's account, preventing cross-account access\n Action: s3:*\n Resource:\n - !Sub arn:aws:s3:::<example_resource_name>\n - !Sub arn:aws:s3:::<example_resource_name>/*\n```",
|
||||
"Other": "1. In the AWS console, go to S3 > Buckets > select the bucket\n2. Open the Permissions tab > Bucket policy\n3. Click Delete bucket policy (or remove all statements) and Save\n4. If a policy is required, ensure all statements only use your account as Principal (arn:aws:iam::<YOUR_ACCOUNT_ID>:root); remove any other accounts or \"*\"",
|
||||
"Terraform": "```hcl\n# Terraform: restrict bucket policy to this AWS account only\nresource \"aws_s3_bucket_policy\" \"<example_resource_name>\" {\n bucket = \"<example_resource_name>\"\n policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Principal = { AWS = \"arn:aws:iam::<example_resource_id>:root\" } # Critical: limits access to the bucket owner's account, preventing cross-account access\n Action = \"s3:*\"\n Resource = [\n \"arn:aws:s3:::<example_resource_name>\",\n \"arn:aws:s3:::<example_resource_name>/*\"\n ]\n }]\n })\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Review and update your S3 bucket policies to remove permissions that grant external AWS accounts access to critical actions and implement least privilege principles to ensure sensitive operations are restricted to trusted accounts only",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
"Text": "Enforce **least privilege**: limit bucket policy `Principal` to your account or approved org IDs with fixed values; avoid wildcards.\n\nUse **role-based cross-account access** with scoped permissions when needed. Add **defense-in-depth** conditions (private networks, TLS), and periodically review for unintended external access.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_cross_account_access"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"identity-access",
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+17
-12
@@ -1,33 +1,38 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_cross_region_replication",
|
||||
"CheckTitle": "Check if S3 buckets use cross region replication.",
|
||||
"CheckTitle": "S3 bucket has cross-region replication configured to a bucket in a different region",
|
||||
"CheckType": [
|
||||
"Secure access management"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Data Destruction"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Verifying whether S3 buckets have cross-region replication enabled, ensuring data redundancy and availability across multiple AWS regions",
|
||||
"Risk": "Without cross-region replication in S3 buckets, data is at risk of being lost or inaccessible if an entire region goes down, leading to potential service disruptions and data unavailability.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html",
|
||||
"Description": "**Amazon S3 buckets** use **cross-Region replication** with `versioning` and an enabled rule that targets a destination bucket in a different AWS Region.\n\nBuckets with same-Region targets, missing destinations, or disabled `versioning` don't meet this replication posture.",
|
||||
"Risk": "**Single-Region storage** creates an availability gap: a Regional outage, control-plane isolation, or denial of service can make data **unreachable**.\n\nLack of replication raises RPO/RTO, delaying recovery and disrupting multi-Region workloads. Missing replicas also weaken data **integrity** during restore from corruption or deletion.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-7",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-7",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled#terraform"
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable versioning and CRR to a bucket in another region\nResources:\n ExampleBucket:\n Type: AWS::S3::Bucket\n Properties:\n VersioningConfiguration:\n Status: Enabled # critical: enables versioning (required for replication)\n ReplicationConfiguration: # critical: enables cross-Region replication\n Role: !GetAtt ReplicationRole.Arn\n Rules:\n - Status: Enabled # critical: replication rule must be enabled\n Destination:\n Bucket: arn:aws:s3:::<example_destination_bucket_name> # critical: destination bucket ARN in a different region\n\n ReplicationRole:\n Type: AWS::IAM::Role\n Properties:\n AssumeRolePolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Principal:\n Service: s3.amazonaws.com\n Action: sts:AssumeRole\n Policies:\n - PolicyName: s3-replication-minimal\n PolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Action:\n - s3:ListBucket\n - s3:GetReplicationConfiguration\n Resource: !Sub arn:aws:s3:::${ExampleBucket}\n - Effect: Allow\n Action:\n - s3:GetObjectVersionForReplication\n - s3:GetObjectVersionAcl\n - s3:GetObjectVersionTagging\n Resource: !Sub arn:aws:s3:::${ExampleBucket}/*\n - Effect: Allow\n Action:\n - s3:ReplicateObject\n - s3:ReplicateDelete\n - s3:ReplicateTags\n Resource: arn:aws:s3:::<example_destination_bucket_name>/*\n```",
|
||||
"Other": "1. In the S3 console, open the source bucket\n2. Go to Properties > Bucket Versioning and click Enable\n3. Go to Management > Replication rules > Create replication rule\n4. Scope: Apply to all objects in the bucket\n5. Destination: Select a bucket in a different AWS Region\n6. Status: Ensure Enabled is selected\n7. IAM role: Choose Create new role (recommended)\n8. Save the rule",
|
||||
"Terraform": "```hcl\n# Enable versioning and minimal CRR to a bucket in another region\nresource \"aws_s3_bucket\" \"source\" {\n bucket = \"<example_resource_name>\"\n\n versioning { \n enabled = true # critical: required for replication\n }\n\n replication_configuration { \n role = aws_iam_role.replication.arn # critical: role used by S3 to replicate\n\n rules {\n status = \"Enabled\" # critical: replication rule must be enabled\n destination {\n bucket = \"arn:aws:s3:::<example_destination_bucket_name>\" # critical: destination bucket ARN in a different region\n }\n }\n }\n}\n\nresource \"aws_iam_role\" \"replication\" {\n name = \"<example_resource_name>-s3-replication-role\"\n assume_role_policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Principal = { Service = \"s3.amazonaws.com\" }\n Action = \"sts:AssumeRole\"\n }]\n })\n}\n\nresource \"aws_iam_role_policy\" \"replication\" {\n name = \"<example_resource_name>-s3-replication-policy\"\n role = aws_iam_role.replication.id\n policy = jsonencode({\n Version = \"2012-10-17\",\n Statement = [\n {\n Effect = \"Allow\",\n Action = [\"s3:ListBucket\", \"s3:GetReplicationConfiguration\"],\n Resource = \"arn:aws:s3:::${aws_s3_bucket.source.bucket}\"\n },\n {\n Effect = \"Allow\",\n Action = [\n \"s3:GetObjectVersionForReplication\",\n \"s3:GetObjectVersionAcl\",\n \"s3:GetObjectVersionTagging\"\n ],\n Resource = \"arn:aws:s3:::${aws_s3_bucket.source.bucket}/*\"\n },\n {\n Effect = \"Allow\",\n Action = [\"s3:ReplicateObject\", \"s3:ReplicateDelete\", \"s3:ReplicateTags\"],\n Resource = \"arn:aws:s3:::<example_destination_bucket_name>/*\"\n }\n ]\n })\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that S3 buckets have cross region replication.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough1.html"
|
||||
"Text": "Enable **CRR** to a different Region with `versioning` and least-privilege roles.\n\n- Replicate needed prefixes and metadata\n- Consider `S3 Replication Time Control` for tighter RPO\n- Protect deletes via `delete marker` strategy and Object Lock\n- Monitor replication metrics and test DR regularly\n\nAlign with **defense in depth** and availability by design.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_cross_region_replication"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"redundancy"
|
||||
"resilience"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+19
-11
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_default_encryption",
|
||||
"CheckTitle": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.",
|
||||
"CheckTitle": "S3 bucket has default server-side encryption (SSE) enabled",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.",
|
||||
"Risk": "Amazon S3 default encryption provides a way to set the default encryption behavior for an S3 bucket. This will ensure data-at-rest is encrypted.",
|
||||
"Description": "**Amazon S3 buckets** have a default **server-side encryption** setting that automatically encrypts new objects using `SSE-S3` or `SSE-KMS`. This evaluates whether a bucket has a default encryption configuration defined.",
|
||||
"Risk": "Without default encryption, older objects may remain unencrypted and new uploads won't be forced to use `SSE-KMS`. This reduces confidentiality and governance by limiting key audit logs, rotation, and cross-account controls, and increases exposure if data is copied, replicated, or accessed outside intended paths.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/bucket-encryption.html",
|
||||
"https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/",
|
||||
"https://docs.aws.amazon.com/us_en/AmazonS3/latest/userguide/default-encryption-faq.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3api put-bucket-encryption --bucket <bucket_name> --server-side-encryption-configuration '{'Rules': [{'ApplyServerSideEncryptionByDefault': {'SSEAlgorithm': 'AES256'}}]}'",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/s3-policies/s3_14-data-encrypted-at-rest#cloudformation",
|
||||
"Other": "",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/s3-policies/s3_14-data-encrypted-at-rest#terraform"
|
||||
"CLI": "aws s3api put-bucket-encryption --bucket <bucket_name> --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"AES256\"}}]}'",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n BucketEncryption:\n ServerSideEncryptionConfiguration:\n - ServerSideEncryptionByDefault:\n SSEAlgorithm: AES256 # Critical: enables default SSE-S3 so new objects are encrypted\n```",
|
||||
"Other": "1. Open the AWS S3 console and select the bucket\n2. Go to the Properties tab\n3. In Default encryption, click Edit\n4. Enable default encryption and select SSE-S3 (AES-256)\n5. Click Save changes",
|
||||
"Terraform": "```hcl\nresource \"aws_s3_bucket\" \"<example_resource_name>\" {\n bucket = \"<example_resource_name>\"\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"<example_resource_name>\" {\n bucket = aws_s3_bucket.<example_resource_name>.id\n\n rule {\n apply_server_side_encryption_by_default {\n sse_algorithm = \"AES256\" # Critical: enables default SSE-S3 for the bucket\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that S3 buckets have encryption at rest enabled.",
|
||||
"Url": "https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/"
|
||||
"Text": "Enable default encryption on all buckets, preferring `SSE-KMS` for sensitive data to retain key control and auditing. Enforce encryption with restrictive bucket policies, apply **least privilege** to KMS keys with rotation, and re-encrypt existing objects. Use **defense in depth** monitoring to detect drift and noncompliant uploads.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_default_encryption"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+21
-13
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_event_notifications_enabled",
|
||||
"CheckTitle": "Check if S3 buckets have event notifications enabled.",
|
||||
"CheckTitle": "S3 bucket has event notifications enabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"Severity": "medium",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Ensure whether S3 buckets have event notifications enabled.",
|
||||
"Risk": "Without event notifications, important actions on S3 buckets may go unnoticed, leading to missed opportunities for timely response to critical changes, such as object creation, deletion, or updates that could impact data security and availability.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html#supported-notification-event-types",
|
||||
"Description": "**Amazon S3 buckets** define a **notification configuration** that publishes bucket events (for example `s3:ObjectCreated:*`, `s3:ObjectRemoved:*`) to a destination. The evaluation identifies buckets that lack any notification setup.",
|
||||
"Risk": "Missing notifications leaves object and bucket changes **unseen**, weakening **integrity** and **availability** oversight. Undetected deletions, policy drift, or replication issues can stall data pipelines (S3 to Lambda/SQS), slow incident response, and allow tampering or exfiltration to persist longer.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-11",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-11",
|
||||
"Terraform": ""
|
||||
"CLI": "aws s3api put-bucket-notification-configuration --bucket <BUCKET_NAME> --notification-configuration '{\"EventBridgeConfiguration\": {}}'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable S3 event notifications via EventBridge\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n NotificationConfiguration:\n EventBridgeConfiguration: {} # Critical: turns on EventBridge notifications, making notifications enabled\n```",
|
||||
"Other": "1. Open the S3 console and select your bucket\n2. Go to the Properties tab\n3. In Event notifications, find Amazon EventBridge and turn it On (Enable)\n4. Click Save changes",
|
||||
"Terraform": "```hcl\n# Enable S3 event notifications via EventBridge\nresource \"aws_s3_bucket_notification\" \"<example_resource_name>\" {\n bucket = \"<example_resource_name>\"\n\n eventbridge {} # Critical: enables EventBridge delivery, satisfying notifications enabled\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable event notifications for all S3 general-purpose buckets to monitor important events such as object creation, deletion, tagging, and lifecycle events, ensuring visibility and quick action on relevant changes.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html"
|
||||
"Text": "Enable **S3 event notifications** for relevant events (e.g., `s3:ObjectCreated:*`, `s3:ObjectRemoved:*`) and route to controlled destinations (SNS, SQS, Lambda, EventBridge).\n\nUse prefix/suffix filters, avoid recursive triggers, and enforce **least privilege** on targets. Pair with object-level logging for **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_event_notifications_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"logging"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_kms_encryption",
|
||||
"CheckTitle": "Check if S3 buckets have KMS encryption enabled.",
|
||||
"CheckTitle": "S3 bucket has server-side encryption with AWS KMS",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have KMS encryption enabled.",
|
||||
"Risk": "Amazon S3 KMS encryption provides a way to set the encryption behavior for an S3 bucket using a managed key. This will ensure data-at-rest is encrypted.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html",
|
||||
"Description": "**Amazon S3 buckets** use server-side encryption with **AWS KMS** keys, including dual-layer `aws:kms:dsse`. The evaluation identifies buckets whose default encryption is `aws:kms` or `aws:kms:dsse` rather than SSE-S3.",
|
||||
"Risk": "Without **KMS-based encryption**, data relies only on SSE-S3, reducing **confidentiality** controls. Missing key policies and grants weakens **least privilege**, cross-account scoping, and the ability to disable or rotate keys. Lack of **KMS audit trails** obscures key usage, hindering detection of misuse and **defense in depth**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/encrypted-with-kms-customer-master-keys.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws put-bucket-encryption --bucket <BUCKET_NAME> --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"aws:kms\",\"KMSMasterKeyID\":\"arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>\"}}]}'",
|
||||
"NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/encrypted-with-kms-customer-master-keys.html",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/encrypted-with-kms-customer-master-keys.html",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default#terraform"
|
||||
"CLI": "aws s3api put-bucket-encryption --bucket <BUCKET_NAME> --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"aws:kms\"}}]}'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: enable default SSE-KMS on the bucket\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n BucketEncryption:\n ServerSideEncryptionConfiguration:\n - ServerSideEncryptionByDefault:\n SSEAlgorithm: aws:kms # Critical: sets default encryption to AWS KMS (SSE-KMS)\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 and open the target bucket\n2. Select the Properties tab\n3. Under Default encryption, click Edit\n4. Choose Server-side encryption with AWS KMS keys (SSE-KMS)\n5. Leave AWS managed key (aws/s3) selected (or choose your CMK if required)\n6. Click Save changes",
|
||||
"Terraform": "```hcl\n# Enable default SSE-KMS on an existing S3 bucket\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"<example_resource_name>\" {\n bucket = \"<example_bucket_name>\"\n\n rule {\n apply_server_side_encryption_by_default {\n sse_algorithm = \"aws:kms\" # Critical: enforces SSE-KMS by default\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that S3 buckets have encryption at rest enabled using KMS.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html"
|
||||
"Text": "Enable default **SSE-KMS** (or **DSSE-KMS** for highly sensitive data). Use a customer-managed key, enforce **least privilege** and separation of duties for key usage, and require KMS encryption via bucket policy (specify `aws:kms` and a designated key). Monitor key activity in **CloudTrail** and consider **S3 Bucket Keys** to control cost.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_kms_encryption"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+23
-18
@@ -1,36 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_level_public_access_block",
|
||||
"CheckTitle": "Check S3 Bucket Level Public Access Block.",
|
||||
"CheckTitle": "S3 bucket has Block Public Access with IgnorePublicAcls and RestrictPublicBuckets enabled at bucket or account level",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"Severity": "medium",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check S3 Bucket Level Public Access Block.",
|
||||
"Risk": "Public access policies may be applied to sensitive data buckets.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html",
|
||||
"Description": "**Amazon S3 buckets** are evaluated for **Block Public Access** settings, ensuring `ignore_public_acls` and `restrict_public_buckets` are enabled at the bucket or account scope.\n\n*Account-wide protections, when present, are treated as effective for the bucket.*",
|
||||
"Risk": "Absent **S3 Block Public Access**, public ACLs or broad policies can grant Internet or cross-account access.\n- Data disclosure (confidentiality)\n- Object overwrite or uploads (integrity)\n- Deletion or outages from misuse (availability)",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/bucket-public-access-block.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3api put-public-access-block --region <REGION_NAME> --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --bucket <BUCKET_NAME>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/s3/s3/block-public-access",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/s3-policies/bc_aws_s3_20#terraform"
|
||||
"CLI": "aws s3api put-public-access-block --bucket <BUCKET_NAME> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true",
|
||||
"NativeIaC": "```yaml\n# CloudFormation - enable required S3 Block Public Access settings on a bucket\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n PublicAccessBlockConfiguration:\n IgnorePublicAcls: true # CRITICAL: Ignore public ACLs on the bucket/objects\n RestrictPublicBuckets: true # CRITICAL: Restrict buckets with public policies to same-account/AWS services\n```",
|
||||
"Other": "1. In AWS Console, open S3 and select the target bucket\n2. Go to Permissions > Block public access (bucket settings)\n3. Enable only:\n - Ignore public ACLs\n - Restrict public buckets\n4. Click Save changes\n5. (Alternatively, to apply account-wide) S3 > Account settings > Block Public Access: enable the same two options and Save",
|
||||
"Terraform": "```hcl\n# Enable required S3 Block Public Access settings on a bucket\nresource \"aws_s3_bucket_public_access_block\" \"<example_resource_name>\" {\n bucket = \"<example_resource_id>\"\n ignore_public_acls = true # CRITICAL: Ignore public ACLs\n restrict_public_buckets = true # CRITICAL: Restrict public buckets\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "You can enable Public Access Block at the bucket level to prevent the exposure of your data stored in S3.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
"Text": "Enable **Block Public Access** at account and bucket levels with `block_public_acls`, `ignore_public_acls`, `block_public_policy`, and `restrict_public_buckets` set to `true`. Apply **least privilege** and **defense in depth**. *If public access is required*, narrowly scope policies to fixed principals and conditions.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_level_public_access_block"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Tags": {
|
||||
"Tag1Key": "value",
|
||||
"Tag2Key": "value"
|
||||
},
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_lifecycle_enabled",
|
||||
"CheckTitle": "Check if S3 buckets have a Lifecycle configuration enabled",
|
||||
"CheckTitle": "S3 bucket has a lifecycle configuration enabled",
|
||||
"CheckType": [
|
||||
"AWS Foundational Security Best Practices"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have Lifecycle configuration enabled.",
|
||||
"Risk": "The risks of not having lifecycle management enabled for S3 buckets include higher storage costs, unmanaged data retention, and potential non-compliance with data policies.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html",
|
||||
"Description": "**Amazon S3 buckets** use **Lifecycle configurations** with at least one rule `Status: Enabled` to automate object `Transitions` and `Expiration` based on age, prefix, or tags",
|
||||
"Risk": "Without lifecycle rules, objects persist indefinitely, driving costs and retaining sensitive data beyond policy. Unchecked log/version growth strains operations and recovery. Long-lived data increases exposure if the account is compromised and can break required deletion timelines, affecting confidentiality and availability.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-13",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-set-lifecycle-configuration-intro.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/lifecycle-configuration.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-13",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/lifecycle-configuration.html"
|
||||
"CLI": "aws s3api put-bucket-lifecycle-configuration --bucket <BUCKET_NAME> --lifecycle-configuration '{\"Rules\":[{\"Status\":\"Enabled\",\"Filter\":{\"Prefix\":\"\"},\"AbortIncompleteMultipartUpload\":{\"DaysAfterInitiation\":7}}]}'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: enable a minimal S3 Lifecycle configuration\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n LifecycleConfiguration: # CRITICAL: Adds a Lifecycle configuration to the bucket\n Rules:\n - Status: Enabled # CRITICAL: Rule must be Enabled to pass the check\n Filter:\n Prefix: \"\" # Applies to all objects\n AbortIncompleteMultipartUpload:\n DaysAfterInitiation: 7 # Minimal action to satisfy schema\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 and open the target bucket\n2. Select the Management tab, then click Create lifecycle rule\n3. Enter a name and choose This rule applies to all objects in the bucket\n4. Under Lifecycle rule actions, select Clean up incomplete multipart uploads and set Days after initiation to 7\n5. Ensure Status is Enabled and click Create rule",
|
||||
"Terraform": "```hcl\n# Minimal lifecycle configuration to mark the bucket as having an enabled rule\nresource \"aws_s3_bucket_lifecycle_configuration\" \"<example_resource_name>\" {\n bucket = \"<example_resource_name>\"\n\n rule {\n status = \"Enabled\" # CRITICAL: Enables lifecycle rule to pass the check\n filter {} # Applies to all objects\n\n abort_incomplete_multipart_upload {\n days_after_initiation = 7 # Minimal action to satisfy schema\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable lifecycle policies on your S3 buckets to automatically manage the transition and expiration of data.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-set-lifecycle-configuration-intro.html"
|
||||
"Text": "Define **Lifecycle policies** by data classification: set `Expiration` to enforce retention, use `Transitions` to lower-cost classes, and enable `AbortIncompleteMultipartUpload`. For critical logs, keep versioning and, *if required*, **Object Lock**. Limit who can change lifecycle using least privilege and separation of duties.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_lifecycle_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
+20
-11
@@ -1,32 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_no_mfa_delete",
|
||||
"CheckTitle": "Check if S3 bucket MFA Delete is not enabled.",
|
||||
"CheckTitle": "S3 bucket has MFA Delete enabled",
|
||||
"CheckType": [
|
||||
"Logging and Monitoring"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Destruction"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 bucket MFA Delete is not enabled.",
|
||||
"Risk": "Your security credentials are compromised or unauthorized access is granted.",
|
||||
"Description": "**Amazon S3 buckets** are assessed for **MFA Delete** status. MFA Delete requires a second factor to permanently delete object versions or change `Versioning` configuration. The finding highlights buckets where this protection is not enabled.",
|
||||
"Risk": "Without **MFA Delete**, a compromised or over-privileged identity can irrevocably purge object history or change versioning.\n\nThis erases recovery points, degrading data **availability**, weakening **integrity**, and increasing the blast radius of account compromise or ransomware.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingMFADelete.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3api put-bucket-versioning --profile my-root-profile --bucket my-bucket-name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa 'arn:aws:iam::00000000:mfa/root-account-mfa-device 123456'",
|
||||
"CLI": "aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa \"<MFA_SERIAL_OR_ARN> <MFA_CODE>\"",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/s3-policies/bc_aws_s3_24#terraform"
|
||||
"Other": "1. Sign in to the AWS Management Console as the root user\n2. Open the account menu > Security credentials > Multi-factor authentication (MFA) and assign an MFA device; copy its ARN/serial\n3. From a machine configured to use the root user credentials, run:\n\n```bash\naws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa \"<MFA_SERIAL_OR_ARN> <MFA_CODE>\"\n```",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html"
|
||||
"Text": "Enable **MFA Delete** on sensitive, versioned buckets so permanent deletions and `Versioning` changes require a second factor. Apply **least privilege** to restrict version purge actions, enforce **change control**, and combine with **Object Lock** or immutable backups for defense in depth.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_no_mfa_delete"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"identity-access"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+21
-12
@@ -1,32 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_object_lock",
|
||||
"CheckTitle": "Check if S3 buckets have object lock enabled",
|
||||
"CheckTitle": "S3 bucket has Object Lock enabled",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Data Destruction"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have object lock enabled",
|
||||
"Risk": "Store objects using a write-once-read-many (WORM) model to help you prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely. That helps to prevent ransomware attacks.",
|
||||
"Description": "**Amazon S3 buckets** have **Object Lock** enabled at the bucket level, applying WORM controls to object versions",
|
||||
"Risk": "Without **Object Lock**, object versions can be deleted or overwritten, undermining data **integrity** and **availability**.\n\nThreats include ransomware erasing backups, insider or mistaken deletions, and tampering that defeats recovery. Inability to enforce retention or legal holds increases exposure to data loss and compliance gaps.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html",
|
||||
"https://aws.amazon.com/about-aws/whats-new/2018/11/s3-object-lock/",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/object-lock.html",
|
||||
"https://docs.aws.amazon.com/de_de/cli/latest/reference/s3api/put-object-lock-configuration.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3 put-object-lock-configuration --bucket <BUCKET_NAME> --object-lock-configuration '{\"ObjectLockEnabled\":\"Enabled\",\"Rule\":{\"DefaultRetention\":{\"Mode\":\"GOVERNANCE\",\"Days\":1}}}'",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/object-lock.html",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-s3-bucket-has-lock-configuration-enabled-by-default#terraform"
|
||||
"CLI": "aws s3api put-object-lock-configuration --bucket <BUCKET_NAME> --object-lock-configuration '{\"ObjectLockEnabled\":\"Enabled\",\"Rule\":{\"DefaultRetention\":{\"Mode\":\"GOVERNANCE\",\"Days\":1}}}'",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n ObjectLockEnabled: true # CRITICAL: Enables Object Lock on the bucket at creation\n ObjectLockConfiguration:\n ObjectLockEnabled: Enabled # CRITICAL: Turns on Object Lock configuration\n Rule:\n DefaultRetention:\n Mode: GOVERNANCE # CRITICAL: Sets default retention mode\n Days: 1 # CRITICAL: Minimal retention to enable default lock\n```",
|
||||
"Other": "1. Open the AWS S3 console and select the target bucket\n2. Go to the Properties tab\n3. Find Object Lock and click Edit\n4. Enable Object Lock\n5. Set Default retention: Mode = Governance, Days = 1\n6. Click Save changes\n\nNote: If the bucket was not created with Object Lock, create a new bucket with Object Lock enabled and migrate objects.",
|
||||
"Terraform": "```hcl\nresource \"aws_s3_bucket_object_lock_configuration\" \"<example_resource_name>\" {\n bucket = \"<example_resource_name>\"\n object_lock_enabled = \"Enabled\" # CRITICAL: Enables Object Lock configuration on the bucket\n rule {\n default_retention {\n mode = \"GOVERNANCE\" # CRITICAL: Default retention mode\n days = 1 # CRITICAL: Minimal retention period\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that your Amazon S3 buckets have Object Lock feature enabled in order to prevent the objects they store from being deleted.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html"
|
||||
"Text": "Enable **Object Lock** for critical data and set appropriate default retention in `GOVERNANCE` or `COMPLIANCE` mode.\n\nApply **immutability** and **least privilege** by restricting permissions that bypass retention, and use legal holds when you need indefinite protection for investigations or regulatory requirements.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_object_lock"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"resilience"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+20
-12
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_object_versioning",
|
||||
"CheckTitle": "Check if S3 buckets have object versioning enabled",
|
||||
"CheckTitle": "S3 bucket has object versioning enabled",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Destruction"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have object versioning enabled",
|
||||
"Risk": "With versioning, you can easily recover from both unintended user actions and application failures.",
|
||||
"Description": "**Amazon S3 buckets** are evaluated for **object versioning** being `Enabled`, which maintains multiple versions of the same object key for historical state retention",
|
||||
"Risk": "Without **versioning**, deletions and overwrites remove the only copy, undermining **availability** and **integrity**.\n- Compromised identities or buggy apps can mass-delete/corrupt data\n- No historical versions means limited rollback and irrecoverable loss",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/dev-retired/Versioning.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/s3-policies/s3_16-enable-versioning#aws-console",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/s3-policies/s3_16-enable-versioning#terraform"
|
||||
"CLI": "aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: enable versioning on an S3 bucket\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n VersioningConfiguration:\n Status: Enabled # Critical: turns on object versioning to pass the check\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 > Buckets and select the target bucket\n2. Open the Properties tab\n3. Find Bucket Versioning and click Edit\n4. Select Enable and click Save changes",
|
||||
"Terraform": "```hcl\n# Enable versioning on an existing S3 bucket\nresource \"aws_s3_bucket_versioning\" \"<example_resource_name>\" {\n bucket = \"<example_resource_name>\"\n versioning_configuration {\n status = \"Enabled\" # Critical: enables bucket versioning to remediate the finding\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Configure versioning using the Amazon console or API for buckets with sensitive information that is changing frequently, and backup may not be enough to capture all the changes.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html"
|
||||
"Text": "Enable **S3 versioning** for buckets holding important or shared data.\n- Enforce **least privilege** to limit delete/overwrite\n- Use **Object Lock** and/or **MFA Delete** for stronger protection\n- Apply **lifecycle rules** to manage noncurrent versions and costs\n- Layer with backups/replication for **defense in depth**",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_object_versioning"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"resilience"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+18
-11
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_policy_public_write_access",
|
||||
"CheckTitle": "Check if S3 buckets have policies which allow WRITE access.",
|
||||
"CheckTitle": "S3 bucket policy does not allow public write access",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Destruction",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have policies which allow WRITE access.",
|
||||
"Risk": "Non intended users can put objects in a given bucket.",
|
||||
"Description": "**Amazon S3 bucket policies** are evaluated for **public write permissions** (e.g., `s3:PutObject`, `s3:Delete*`, or `s3:*`). Account or bucket **Public Access Block** that restricts public buckets is considered when determining exposure.",
|
||||
"Risk": "Public write access lets anyone upload, overwrite, or delete objects, undermining **integrity** and **availability**. Attackers can plant malware, stage phishing content, poison data, or wipe buckets, causing outages and potential legal and cost impacts from storage abuse and content hosting.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/s3-policies/s3_18-write-permissions-public#aws-console",
|
||||
"Terraform": ""
|
||||
"CLI": "aws s3api put-public-access-block --bucket <BUCKET_NAME> --public-access-block-configuration RestrictPublicBuckets=true",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable bucket-level Public Access Block to prevent public policies from granting write\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n PublicAccessBlockConfiguration:\n RestrictPublicBuckets: true # Critical: blocks public access granted by any public bucket policy\n```",
|
||||
"Other": "1. Open the AWS S3 console and select the target bucket\n2. Go to the Permissions tab\n3. Under Block public access (bucket settings), click Edit\n4. Enable \"Block public and cross-account access to buckets and objects through any public bucket or access point policies\"\n5. Click Save changes",
|
||||
"Terraform": "```hcl\n# Enable bucket-level Public Access Block so public bucket policies (including write) are blocked\nresource \"aws_s3_bucket_public_access_block\" \"<example_resource_name>\" {\n bucket = \"<example_resource_id>\"\n restrict_public_buckets = true # Critical: prevents public access granted via bucket policies\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure proper bucket policy is in place with the least privilege principle applied.",
|
||||
"Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket.html"
|
||||
"Text": "Restrict writes to trusted principals using **least privilege**; avoid `Principal: \"*\"`. Enable **Public Access Block** at account and bucket levels for defense in depth. Prefer IAM roles over broad bucket policies, require private access paths, and enable versioning to recover from unwanted changes.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_policy_public_write_access"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-11
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_public_access",
|
||||
"CheckTitle": "Ensure there are no S3 buckets open to Everyone or Any AWS user.",
|
||||
"CheckTitle": "S3 bucket is not publicly accessible to Everyone or Authenticated Users",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Ensure there are no S3 buckets open to Everyone or Any AWS user.",
|
||||
"Risk": "Even if you enable all possible bucket ACL options available in the Amazon S3 console the ACL alone does not allow everyone to download objects from your bucket. Depending on which option you select any user could perform some actions.",
|
||||
"Description": "**Amazon S3 buckets** are evaluated for **public access** via ACLs and bucket policies. The check identifies account or bucket `PublicAccessBlock` protections (`IgnorePublicAcls`, `RestrictPublicBuckets`) and flags buckets granting group access to `AllUsers` or `AuthenticatedUsers`, or with a public bucket policy.",
|
||||
"Risk": "Publicly accessible buckets jeopardize **confidentiality** through unauthenticated reads, **integrity** through write or ACL changes, and **availability** via object deletion or overwrite. Attackers can mass-exfiltrate data, host malware, or pivot after discovering secrets stored in objects.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/id_id/kitchensink/latest/testguide/access-control-block-public-access.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3api put-public-access-block --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --bucket <bucket_name>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/s3/s3/block-public-access",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached#terraform"
|
||||
"CLI": "aws s3api put-public-access-block --bucket <bucket_name> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable minimal S3 Block Public Access on the bucket\nResources:\n ExampleBucket:\n Type: AWS::S3::Bucket\n Properties:\n PublicAccessBlockConfiguration:\n IgnorePublicAcls: true # Critical: ignores any public ACL grants (AllUsers/AuthenticatedUsers)\n RestrictPublicBuckets: true # Critical: restricts buckets with public policies to same-account/service principals\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 and open the bucket <example_resource_name>\n2. Select the Permissions tab\n3. Under Block public access (bucket settings), click Edit\n4. Check only:\n - Ignore public ACLs (true)\n - Restrict public buckets (true)\n5. Click Save changes and confirm",
|
||||
"Terraform": "```hcl\n# Enable minimal S3 Block Public Access on the bucket\nresource \"aws_s3_bucket_public_access_block\" \"example\" {\n bucket = \"<example_resource_name>\"\n\n ignore_public_acls = true # Critical: ignores public ACLs\n restrict_public_buckets = true # Critical: restricts buckets with public policies\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "You can enable block public access settings only for access points, buckets and AWS accounts. Amazon S3 does not support block public access settings on a per-object basis. When you apply block public access settings to an account, the settings apply to all AWS Regions globally. The settings might not take effect in all Regions immediately or simultaneously, but they eventually propagate to all Regions.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
"Text": "Enforce defense in depth: enable **S3 Block Public Access** at org/account and bucket levels (`BlockPublicAcls`, `IgnorePublicAcls`, `BlockPublicPolicy`, `RestrictPublicBuckets`). Apply **least privilege** with explicit principals; avoid ACLs via Object Ownership. Use private access patterns (e.g., CloudFront OAC or presigned URLs) and monitor with analyzers.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_public_access"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-11
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_public_list_acl",
|
||||
"CheckTitle": "Ensure there are no S3 buckets listable by Everyone or Any AWS customer.",
|
||||
"CheckTitle": "S3 bucket is not publicly listable by Everyone or any authenticated AWS user",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure",
|
||||
"TTPs/Initial Access/Unauthorized Access"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Ensure there are no S3 buckets listable by Everyone or Any AWS customer.",
|
||||
"Risk": "Even if you enable all possible bucket ACL options available in the Amazon S3 console the ACL alone does not allow everyone to download objects from your bucket. Depending on which option you select any user could perform some actions.",
|
||||
"Description": "**Amazon S3 buckets** are evaluated for **public listing via ACLs**. Grants of `READ`, `READ_ACP`, or `FULL_CONTROL` to the `AllUsers` or `AuthenticatedUsers` groups are identified. Effective **Block Public Access** at account or bucket level (notably `IgnorePublicAcls` and `RestrictPublicBuckets`) is considered in the evaluation.",
|
||||
"Risk": "**Public listability** reveals object names, counts, and structure, enabling reconnaissance and targeted scraping. `READ_ACP` exposes permission details for further abuse. With `FULL_CONTROL`, attackers could alter ACLs and disrupt access, undermining **confidentiality** and risking **integrity** and **availability**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-read-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3api put-bucket-acl --bucket <bucket_name> --acl private",
|
||||
"NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-read-access.html",
|
||||
"Other": "",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-read-access.html"
|
||||
"CLI": "aws s3api put-public-access-block --bucket <bucket_name> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Block public listing via bucket-level Public Access Block\nResources:\n ExamplePublicAccessBlock:\n Type: AWS::S3::BucketPublicAccessBlock\n Properties:\n Bucket: \"<example_resource_name>\"\n PublicAccessBlockConfiguration:\n IgnorePublicAcls: true # Critical: ignore any public ACLs so they don't grant list access\n RestrictPublicBuckets: true # Critical: restrict buckets with public policies to trusted principals\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 and open the bucket\n2. Select the Permissions tab\n3. Click Edit under Block public access (bucket settings)\n4. Enable:\n - Ignore public ACLs (bucket and objects)\n - Restrict public buckets\n5. Click Save",
|
||||
"Terraform": "```hcl\n# Block public listing by enabling bucket-level Public Access Block\nresource \"aws_s3_bucket_public_access_block\" \"<example_resource_name>\" {\n bucket = \"<example_resource_id>\"\n ignore_public_acls = true # Critical: ignore any public ACLs\n restrict_public_buckets = true # Critical: restrict buckets with public policies\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "You can enable block public access settings only for access points, buckets and AWS accounts. Amazon S3 does not support block public access settings on a per-object basis. When you apply block public access settings to an account, the settings apply to all AWS Regions globally. The settings might not take effect in all Regions immediately or simultaneously, but they eventually propagate to all Regions.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
"Text": "Enable account-level **S3 Block Public Access** (`BlockPublicAcls`, `IgnorePublicAcls`, `BlockPublicPolicy`, `RestrictPublicBuckets`).\n- Remove ACL grants to `AllUsers`/`AuthenticatedUsers`; apply **least privilege** with IAM/bucket policies.\n- Favor private patterns (VPC endpoints, CloudFront OAC, presigned URLs) and disable ACLs via Object Ownership.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_public_list_acl"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-10
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_public_write_acl",
|
||||
"CheckTitle": "Ensure there are no S3 buckets writable by Everyone or Any AWS customer.",
|
||||
"CheckTitle": "S3 bucket ACL does not grant write access to Everyone or any AWS customer",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Destruction"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Ensure there are no S3 buckets writable by Everyone or Any AWS customer.",
|
||||
"Risk": "Even if you enable all possible bucket ACL options available in the Amazon S3 console the ACL alone does not allow everyone to download objects from your bucket. Depending on which option you select any user could perform some actions.",
|
||||
"Description": "**Amazon S3 buckets** are assessed for ACL grants that allow **public write** access to `AllUsers` or `AuthenticatedUsers` via `WRITE`, `WRITE_ACP`, or `FULL_CONTROL`. Effective **Block Public Access** at account or bucket level (`ignore_public_acls`, `restrict_public_buckets`) is considered.",
|
||||
"Risk": "Public or cross-account writes enable object tampering, **log poisoning**, and ACL changes via `WRITE_ACP`, undermining **integrity** and causing covert **data exposure**. Attackers can plant malware, deface content, and inflate **costs**, impacting **availability** through overwrites or prefix flooding.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-write-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3api put-bucket-acl --bucket <bucket_name> --acl private",
|
||||
"NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-write-access.html",
|
||||
"Other": "",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-write-access.html"
|
||||
"NativeIaC": "```yaml\n# CloudFormation: ensure bucket is not publicly writable via ACLs\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n PublicAccessBlockConfiguration:\n IgnorePublicAcls: true # Critical: ignores any public ACLs (e.g., AllUsers/AuthenticatedUsers) so write grants don't apply\n RestrictPublicBuckets: true # Critical: restricts public buckets to the account, preventing public writes via policies\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 > Buckets and open <bucket_name>\n2. Go to the Permissions tab > Access control list (ACL) > Edit\n3. Remove any grantee \"Everyone (public access)\" or \"Any AWS account\" with Write, Write ACL, or Full control\n4. Ensure only the bucket owner retains Full control\n5. Click Save changes",
|
||||
"Terraform": "```hcl\n# Ensure the bucket is not publicly writable via ACLs\nresource \"aws_s3_bucket_public_access_block\" \"<example_resource_name>\" {\n bucket = \"<example_resource_name>\"\n ignore_public_acls = true # Critical: disables effect of public ACLs (e.g., AllUsers/AuthenticatedUsers)\n restrict_public_buckets = true # Critical: restricts public buckets to the account to prevent public writes\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "You can enable block public access settings only for access points, buckets and AWS accounts. Amazon S3 does not support block public access settings on a per-object basis. When you apply block public access settings to an account, the settings apply to all AWS Regions globally. The settings might not take effect in all Regions immediately or simultaneously, but they eventually propagate to all Regions.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
|
||||
"Text": "Apply **least privilege** to S3 writes. Enable account-level **Block Public Access** and use **Object Ownership** to disable ACLs. Grant write only to fixed principals via bucket policies with tight conditions (e.g., org IDs, VPC endpoints). Add **versioning** and monitoring for defense-in-depth.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_public_write_acl"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+17
-11
@@ -1,29 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_secure_transport_policy",
|
||||
"CheckTitle": "Check if S3 buckets have secure transport policy.",
|
||||
"CheckTitle": "S3 bucket policy denies requests over insecure transport",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have secure transport policy.",
|
||||
"Risk": "If HTTPS is not enforced on the bucket policy, communication between clients and S3 buckets can use unencrypted HTTP. As a result, sensitive information could be transmitted in clear text over the network or internet.",
|
||||
"Description": "**Amazon S3 buckets** are evaluated for a bucket policy that enforces **secure transport** by denying requests when `aws:SecureTransport` is `false`.\n\nBuckets without this explicit denial, or without a policy, are treated as allowing access over insecure transport.",
|
||||
"Risk": "HTTP access exposes object data and auth details to **eavesdropping** and **man-in-the-middle** attacks. Captured **pre-signed URLs** can be replayed to exfiltrate data. Traffic can be intercepted or altered, undermining **confidentiality** and **integrity** of S3 content.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/secure-transport.html",
|
||||
"https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/s3-policies/s3_15-secure-data-transport#aws-console",
|
||||
"Terraform": ""
|
||||
"CLI": "aws s3api put-bucket-policy --bucket <example_resource_name> --policy '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":\"*\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::<example_resource_name>/*\",\"Condition\":{\"Bool\":{\"aws:SecureTransport\":\"false\"}}}]}'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Deny non-SSL (HTTP) requests to the S3 bucket\nResources:\n BucketPolicy:\n Type: AWS::S3::BucketPolicy\n Properties:\n Bucket: <example_resource_name>\n PolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Deny\n Principal: \"*\"\n Action: s3:*\n Resource: arn:aws:s3:::<example_resource_name>/*\n Condition:\n Bool:\n aws:SecureTransport: \"false\" # Critical: deny requests not using SSL/TLS\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 and open the bucket <example_resource_name>\n2. Select the Permissions tab and click Edit in Bucket policy\n3. Paste this policy, replacing the bucket name:\n ```\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Deny\",\n \"Principal\": \"*\",\n \"Action\": \"s3:*\",\n \"Resource\": \"arn:aws:s3:::<example_resource_name>/*\",\n \"Condition\": { \"Bool\": { \"aws:SecureTransport\": \"false\" } }\n }\n ]\n }\n ```\n4. Click Save changes\n",
|
||||
"Terraform": "```hcl\n# Deny non-SSL (HTTP) requests to the S3 bucket\nresource \"aws_s3_bucket_policy\" \"policy\" {\n bucket = \"<example_resource_name>\"\n policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Deny\"\n Principal = \"*\"\n Action = \"s3:*\"\n Resource = \"arn:aws:s3:::<example_resource_name>/*\"\n Condition = {\n Bool = {\n \"aws:SecureTransport\" = \"false\" # Critical: deny requests not using SSL/TLS\n }\n }\n }]\n })\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that S3 buckets have encryption in transit enabled.",
|
||||
"Url": "https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/"
|
||||
"Text": "Enforce **HTTPS-only** access with a bucket policy that denies requests when `aws:SecureTransport=false`.\n\nPrefer **private access** (VPC endpoints or CloudFront with TLS), avoid S3 website endpoints, apply **least privilege**, use short-lived HTTPS **pre-signed URLs**, and monitor logs for insecure access attempts.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_secure_transport_policy"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-11
@@ -1,32 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_server_access_logging_enabled",
|
||||
"CheckTitle": "Check if S3 buckets have server access logging enabled",
|
||||
"CheckTitle": "S3 bucket has server access logging enabled",
|
||||
"CheckType": [
|
||||
"Logging and Monitoring"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if S3 buckets have server access logging enabled",
|
||||
"Risk": "Server access logs can assist you in security and access audits, help you learn about your customer base, and understand your Amazon S3 bill.",
|
||||
"Description": "**Amazon S3 buckets** are evaluated for **server access logging** configured to record access requests and deliver logs to a designated destination bucket.",
|
||||
"Risk": "Without access logs, object reads, writes, and deletions may go untracked, hindering detection of unauthorized access and data exfiltration. This degrades forensic visibility, delays incident response, and weakens evidence integrity, impacting confidentiality and integrity.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.amazonaws.cn/en_us/config/latest/developerguide/s3-bucket-logging-enabled.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/dev/security-best-practices.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws s3api put-bucket-logging --bucket <BUCKET_NAME> --bucket-logging-status <LOGGING_FILE_JSON>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/s3-policies/s3_13-enable-logging",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/s3-policies/s3_13-enable-logging#terraform"
|
||||
"CLI": "aws s3api put-bucket-logging --bucket <BUCKET_NAME> --bucket-logging-status '{\"LoggingEnabled\":{\"TargetBucket\":\"<LOG_BUCKET>\",\"TargetPrefix\":\"logs/\"}}'",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n LoggingConfiguration:\n DestinationBucketName: <example_resource_id> # CRITICAL: Enables server access logging by sending logs to this bucket\n```",
|
||||
"Other": "1. Open the AWS Management Console and go to S3\n2. Select the bucket with the finding\n3. Go to the Properties tab\n4. In Server access logging, click Edit\n5. Toggle Enable, choose the target log bucket, and Save",
|
||||
"Terraform": "```hcl\nresource \"aws_s3_bucket_logging\" \"<example_resource_name>\" {\n bucket = \"<example_bucket_name>\"\n target_bucket = \"<example_log_bucket_name>\" # CRITICAL: Enables server access logging by specifying the target bucket\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that S3 buckets have Logging enabled. CloudTrail data events can be used in place of S3 bucket logging. If that is the case, this finding can be considered a false positive.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
|
||||
"Text": "Enable **server access logging** and send logs to a dedicated log bucket with least privilege, retention, and monitoring. Complement with **CloudTrail data events** for object-level visibility. Apply **defense in depth** by centralizing logs and protecting them from tampering.",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_server_access_logging_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"logging",
|
||||
"forensics-ready"
|
||||
],
|
||||
"DependsOn": [],
|
||||
|
||||
+18
-11
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_bucket_shadow_resource_vulnerability",
|
||||
"CheckTitle": "Check for S3 buckets vulnerable to Shadow Resource Hijacking (Bucket Monopoly)",
|
||||
"CheckTitle": "S3 bucket is not a known shadow resource owned by another account",
|
||||
"CheckType": [
|
||||
"Effects/Data Exposure"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Data Exposure",
|
||||
"Effects/Data Exfiltration",
|
||||
"TTPs/Collection"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:s3:::bucket_name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsS3Bucket",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Checks for S3 buckets with predictable names that could be hijacked by an attacker before legitimate use, leading to data leakage or other security breaches.",
|
||||
"Risk": "An attacker can pre-create S3 buckets with predictable names used by various AWS services. When a legitimate user's service attempts to use that bucket, it may inadvertently write sensitive data to the attacker-controlled bucket, leading to information disclosure, denial of service, or even remote code execution.",
|
||||
"RelatedUrl": "https://www.aquasec.com/blog/bucket-monopoly-breaching-aws-accounts-through-shadow-resources/",
|
||||
"Description": "**Amazon S3 buckets** using **predictable service naming** (e.g., `aws-glue-assets-<account>-<region>`, `sagemaker-<region>-<account>`) are identified and their **ownership** checked.\n\nBuckets tied to your account that match these patterns but are owned by another account-across regions-are surfaced as shadow-resource candidates.",
|
||||
"Risk": "**Preclaimed buckets** matching your account's patterns let outsiders intercept service artifacts, causing:\n- Loss of **confidentiality** (templates, data exfiltration)\n- Compromised **integrity** (script/config injection RCE, privilege escalation)\n- Reduced **availability** (creation failures or redirected writes)",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.techtarget.com/searchsecurity/news/366602412/Researchers-unveil-AWS-vulnerabilities-shadow-resource-vector",
|
||||
"https://www.aquasec.com/blog/bucket-monopoly-breaching-aws-accounts-through-shadow-resources/#section-10"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "Manually verify the ownership of any flagged S3 buckets. If a bucket is not owned by your account, investigate its origin and purpose. If it is not a legitimate resource, you should avoid using services that may interact with it.",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: pre-claim the predictable S3 bucket name to ensure your account owns it\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n BucketName: <FLAGGED_BUCKET_NAME> # Critical: create the exact bucket name reported by the check so it is owned by this account\n```",
|
||||
"Other": "1. In the Prowler finding, copy the exact bucket name flagged (e.g., aws-glue-assets-<ACCOUNT_ID>-<REGION>).\n2. Open the AWS S3 console and click Create bucket.\n3. Paste the exact bucket name and select the region that matches the name.\n4. Click Create bucket.\n5. Repeat for each flagged name/region so all predictable service buckets are owned by your account.",
|
||||
"Terraform": "```hcl\n# Terraform: pre-claim the predictable S3 bucket name to ensure your account owns it\nresource \"aws_s3_bucket\" \"<example_resource_name>\" {\n bucket = \"<FLAGGED_BUCKET_NAME>\" # Critical: create the exact bucket name reported by the check so it is owned by this account\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that all S3 buckets associated with your AWS account are owned by your account. Be cautious of services that create buckets with predictable names. Whenever possible, pre-create these buckets in all regions to prevent hijacking.",
|
||||
"Url": "https://www.aquasec.com/blog/bucket-monopoly-breaching-aws-accounts-through-shadow-resources/"
|
||||
"Text": "Apply **defense in depth**:\n- **Preprovision and own** required service buckets in all current and planned regions\n- Enforce **least privilege** so services write only to approved bucket names/ARNs\n- Use **non-guessable names** where you control naming\n- Monitor for look-alike buckets and separate duties for bucket creation vs. use",
|
||||
"Url": "https://hub.prowler.com/check/s3_bucket_shadow_resource_vulnerability"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+21
-12
@@ -1,32 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "s3_multi_region_access_point_public_access_block",
|
||||
"CheckTitle": "Block Public Access Settings enabled on Multi Region Access Points.",
|
||||
"CheckTitle": "S3 Multi-Region Access Point has all Block Public Access settings enabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "s3",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:aws:s3:region:account-id:accesspoint/access-point-name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsS3AccessPoint",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Ensures that public access is blocked on S3 Access Points.",
|
||||
"Risk": "Leaving S3 multi region access points open to the public in AWS can lead to data exposure, breaches, compliance violations, unauthorized access, and data integrity issues.",
|
||||
"RelatedUrl": "https://aws.amazon.com/es/getting-started/hands-on/getting-started-with-amazon-s3-multi-region-access-points/",
|
||||
"Description": "**Amazon S3 Multi-Region Access Points** are evaluated for **Block Public Access** being fully enabled (`block_public_acls`, `ignore_public_acls`, `block_public_policy`, `restrict_public_buckets`).\n\nFocus is on the MRAP's own settings, separate from bucket or account configurations.",
|
||||
"Risk": "Without MRAP **Block Public Access**, the global endpoint can accept internet traffic, exposing linked buckets.\n\nThis undermines confidentiality (object listing/reads) and integrity (unauthorized writes or policy abuse), and can trigger costly egress and data tampering across Regions.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/multi-region-access-point-block-public-access.html",
|
||||
"https://aws.amazon.com/es/getting-started/hands-on/getting-started-with-amazon-s3-multi-region-access-points/",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-24"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-24",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: MRAP with Block Public Access enabled (cannot be changed after creation)\nResources:\n <example_resource_name>:\n Type: AWS::S3::MultiRegionAccessPoint\n Properties:\n Name: <example_resource_name>\n PublicAccessBlockConfiguration: # Critical: enable all Block Public Access settings\n BlockPublicAcls: true # Critical: blocks ACLs granting public access\n IgnorePublicAcls: true # Critical: ignores any public ACLs\n BlockPublicPolicy: true # Critical: blocks public bucket policies\n RestrictPublicBuckets: true # Critical: restricts public bucket policies\n Regions:\n - Bucket: <example_bucket_name_1>\n - Bucket: <example_bucket_name_2>\n```",
|
||||
"Other": "1. In the AWS Console, go to S3 > Multi-Region Access Points\n2. Select the failing Multi-Region Access Point and choose Delete (settings cannot be edited after creation)\n3. Click Create Multi-Region Access Point\n4. Enter a name and select at least two buckets in different Regions\n5. Ensure Block public access is enabled for all four settings (default): BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets\n6. Create the Multi-Region Access Point",
|
||||
"Terraform": "```hcl\n# Terraform: MRAP with Block Public Access enabled (must be set at creation)\nresource \"aws_s3control_multi_region_access_point\" \"<example_resource_name>\" {\n account_id = \"<example_account_id>\"\n\n details {\n name = \"<example_resource_name>\"\n\n public_access_block { # Critical: enable all Block Public Access settings\n block_public_acls = true # Critical\n ignore_public_acls = true # Critical\n block_public_policy = true # Critical\n restrict_public_buckets = true # Critical\n }\n\n region { bucket = \"<example_bucket_name_1>\" }\n region { bucket = \"<example_bucket_name_2>\" }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure S3 multi region access points are private by default, applying strict access controls, and regularly auditing permissions to prevent unauthorized public access.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/multi-region-access-point-block-public-access.html"
|
||||
"Text": "Adopt **deny-by-default**: keep all MRAP **Block Public Access** settings enabled; avoid public ACLs or policies.\n- Enforce **least privilege**\n- Prefer private access (VPC endpoints)\n- Periodically review permissions and logs\n\n*MRAP public access settings are immutable after creation.*",
|
||||
"Url": "https://hub.prowler.com/check/s3_multi_region_access_point_public_access_block"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
Reference in New Issue
Block a user