Skip to content

Code review demo #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mikeurbanski1 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Code review demo #60

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2702161
Create new.yaml
mikeurbanski1 Aug 11, 2021
e3efceb
Bridgecrew bot fix for new.yaml
bridgecrew[bot] Nov 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions new.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudFormation Template to deploy insecure infrastructure
Parameters:
CompanyName:
Description: Company Name
Type: String
Default: acme
Environment:
Description: Environment
Type: String
Default: dev
DBName:
Description: Name of the Database
Type: String
Default: db1
Password:
Description: Database Password
Type: String
NoEcho: True
MinLength: 1
MaxLength: 41
AllowedPattern: ^[a-zA-Z0-9]*$
LatestAmiId:
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

Resources:
DataScienceBucket:
Copy link

@bridgecrew bridgecrew bot Aug 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure S3 bucket has ignore public ACLs enabled
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_21

Description

The IgnorePublicAcls setting causes S3 to ignore all public ACLs on a bucket and any objects that it contains. Enabling this setting does not affect the persistence of any existing ACLs and does not prevent new public ACLs from being set.

This setting will block public access granted by ACLs while still allowing PUT Object calls that include a public ACL.

Copy link

@bridgecrew bridgecrew bot Aug 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CRITICAL   S3 Bucket has an ACL defined which allows public READ access.
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_1

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **READ** access to everyone can provide attackers the ability to read object data within the bucket, which can lead to the exposure of sensitive data. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for READ actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

  • NIST-800-53 AC-17

Copy link

@bridgecrew bridgecrew bot Aug 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure S3 bucket has 'restrict_public_bucket' enabled
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_22

Description

The S3 Block Public Access configuration enables specifying whether S3 should restrict public bucket policies for buckets in this account. Setting RestrictPublicBucket to TRUE restricts access to buckets with public policies to only AWS services and authorized users within this account.

Enabling this setting does not affect previously stored bucket policies. Public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.

Copy link

@bridgecrew bridgecrew bot Aug 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure the S3 bucket has access logging enabled
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_13

Description

Access logging provides detailed audit logging for all objects and folders in an S3 bucket.

Benchmarks

  • HIPAA 164.312(B) Audit controls

Copy link

@bridgecrew bridgecrew bot Aug 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in the S3 bucket is securely encrypted at rest
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_14

Description

SSE helps prevent unauthorized access to S3 buckets. Encrypting and decrypting data at the S3 bucket level is transparent to users when accessing data.

Benchmarks

  • PCI-DSS V3.2 3
  • NIST-800-53 AC-17, SC-2
  • PCI-DSS V3.2.1 3.4
  • FEDRAMP (MODERATE) SC-28
  • CIS AWS V1.3 2.1.1

Copy link

@bridgecrew bridgecrew bot Aug 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure S3 bucket has block public ACLS enabled
    Resource: AWS::S3::Bucket.DataScienceBucket | ID: BC_AWS_S3_19

Description

Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.

This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.

We recommend you set S3 Bucket BlockPublicAcls to True.

Benchmarks

  • CIS AWS V1.3 1.20

# not encrypted
Type: AWS::S3::Bucket
DeletionPolicy: Delete
Properties:
BucketName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data-science"
AccessControl: PublicRead
Tags:
- Key: Name
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data-science"
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: AES256