Skip to content

Update cfngoat.yaml #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mikeurbanski1 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update cfngoat.yaml #68

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion cfngoat.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -585,7 +585,17 @@ Resources:
############
### S3 ###
############

DataBucket2:
Copy link

@bridgecrew bridgecrew bot Jan 19, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
DataBucket2:
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
PublicAccessBlockConfiguration:
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
MEDIUM   Ensure S3 bucket RestrictPublicBucket is set to True
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_22

Description

The S3 Block Public Access configuration enables specifying whether S3 should restrict public bucket policies for buckets in this account. Setting RestrictPublicBucket to TRUE restricts access to buckets with public policies to only AWS services and authorized users within this account.

Enabling this setting does not affect previously stored bucket policies. Public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.

Copy link

@bridgecrew bridgecrew bot Jan 19, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
DataBucket2:
DataBucket2:
# Public, not encrypted, no access logs, no versioning
Type: AWS::S3::Bucket
DeletionPolicy: Delete
Properties:
BucketName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
AccessControl: Private
Tags:
- Key: Name
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
CRITICAL   Ensure bucket ACL does not grant READ permission to everyone
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_1

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **READ** access to everyone can provide attackers the ability to read object data within the bucket, which can lead to the exposure of sensitive data. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for READ actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

  • NIST-800-53 AC-17

🪄 Smart Fix -

Fix based on 60% past actions

Copy link

@bridgecrew bridgecrew bot Jan 19, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure AWS access logging is enabled on S3 buckets
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_13

Description

Access logging provides detailed audit logging for all objects and folders in an S3 bucket.

Benchmarks

  • HIPAA 164.312(B) Audit controls

# Public, not encrypted, no access logs, no versioning
Type: AWS::S3::Bucket
DeletionPolicy: Delete
Properties:
BucketName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
AccessControl: PublicRead
Tags:
- Key: Name
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
Copy link

@bridgecrew bridgecrew bot Jan 19, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
VersioningConfiguration:
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
HIGH   Ensure AWS S3 object versioning is enabled
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_16

Description

S3 versioning is a managed data backup and recovery service provided by AWS. When enabled it allows users to retrieve and restore previous versions of their buckets.

S3 versioning can be used for data protection and retention scenarios such as recovering objects that have been accidentally/intentionally deleted or overwritten.

Benchmarks

  • PCI-DSS V3.2.1 10.5.3
  • FEDRAMP (MODERATE) CP-10, SI-12

Copy link

@bridgecrew bridgecrew bot Jan 19, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
HIGH   Ensure data stored in the S3 bucket is securely encrypted at rest
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_14

Description

SSE helps prevent unauthorized access to S3 buckets. Encrypting and decrypting data at the S3 bucket level is transparent to users when accessing data.

Benchmarks

  • PCI-DSS V3.2 3
  • NIST-800-53 AC-17, SC-2
  • PCI-DSS V3.2.1 3.4
  • FEDRAMP (MODERATE) SC-28
  • CIS AWS V1.3 2.1.1

Copy link

@bridgecrew bridgecrew bot Jan 19, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
PublicAccessBlockConfiguration:
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
MEDIUM   Ensure S3 bucket has block public ACLS enabled
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_19

Description

Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.

This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.

We recommend you set S3 Bucket BlockPublicAcls to True.

Benchmarks

  • CIS AWS V1.3 1.20

Copy link

@bridgecrew bridgecrew bot Jan 19, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
PublicAccessBlockConfiguration:
Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
MEDIUM   Ensure S3 bucket IgnorePublicAcls is set to True
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_21

Description

The IgnorePublicAcls setting causes S3 to ignore all public ACLs on a bucket and any objects that it contains. Enabling this setting does not affect the persistence of any existing ACLs and does not prevent new public ACLs from being set.

This setting will block public access granted by ACLs while still allowing PUT Object calls that include a public ACL.


DataBucket:
# Public, not encrypted, no access logs, no versioning
Type: AWS::S3::Bucket
Expand Down