Code review demo

[mikeurbanski1]

No description provided.

[bridgecrew]

Bridgecrew has found 6 infrastructure configuration errors in this PR ⬇️

[bridgecrew]

  Ensure S3 bucket has ignore public ACLs enabled
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_21

Description

The IgnorePublicAcls setting causes S3 to ignore all public ACLs on a bucket and any objects that it contains. Enabling this setting does not affect the persistence of any existing ACLs and does not prevent new public ACLs from being set.

This setting will block public access granted by ACLs while still allowing PUT Object calls that include a public ACL.

[bridgecrew]

  S3 Bucket has an ACL defined which allows public READ access.
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_1

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **READ** access to everyone can provide attackers the ability to read object data within the bucket, which can lead to the exposure of sensitive data. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for READ actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

• NIST-800-53 AC-17

[bridgecrew]

  Ensure S3 bucket has 'restrict_public_bucket' enabled
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_22

Description

The S3 Block Public Access configuration enables specifying whether S3 should restrict public bucket policies for buckets in this account. Setting RestrictPublicBucket to TRUE restricts access to buckets with public policies to only AWS services and authorized users within this account.

Enabling this setting does not affect previously stored bucket policies. Public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.

[bridgecrew]

  Ensure the S3 bucket has access logging enabled
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_13

Description

Access logging provides detailed audit logging for all objects and folders in an S3 bucket.

Benchmarks

• HIPAA 164.312(B) Audit controls

[bridgecrew]

  Ensure all data stored in the S3 bucket is securely encrypted at rest
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_14

Description

SSE helps prevent unauthorized access to S3 buckets. Encrypting and decrypting data at the S3 bucket level is transparent to users when accessing data.

Benchmarks

• PCI-DSS V3.2 3
• NIST-800-53 AC-17, SC-2
• PCI-DSS V3.2.1 3.4
• FEDRAMP (MODERATE) SC-28
• CIS AWS V1.3 2.1.1

[bridgecrew]

  Ensure S3 bucket has block public ACLS enabled
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_19

Description

Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.

This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.

We recommend you set S3 Bucket BlockPublicAcls to True.

Benchmarks

• CIS AWS V1.3 1.20