Skip to content

Commit 0934441

Browse files
james-zhou-inspire11james-zhou-inspire11
committed
feat(CG-1286): add storage rules support
1 parent 4e80389 commit 0934441

10 files changed

Lines changed: 951 additions & 1 deletion

‎src/aws/cis-1.5.0/README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,4 +57,10 @@ Policy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d
5757

5858
| Rule | Description |
5959
| ------------- | --------------------------------------------------------------------------------------------------------------------------- |
60-
60+
| AWS CIS 2.1.1 | Ensure all S3 buckets employ encryption-at-rest |
61+
| AWS CIS 2.1.2 | Ensure S3 Bucket Policy allows HTTPS requests |
62+
| AWS CIS 2.1.3 | Ensure MFA Delete is enable on S3 buckets |
63+
| AWS CIS 2.1.4 | Ensure all data in Amazon S3 has been discovered, classified and secured when required. |
64+
| AWS CIS 2.1.5 | Ensure that S3 Buckets are configured with 'Block public access (bucket settings)' |
65+
| AWS CIS 2.2.1 | Ensure EBS volume encryption is enabled |
66+
| AWS CIS 2.3.1 | Ensure that encryption is enabled for RDS Instances |

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-2.1.1.ts‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
// AWS NIST 800-53-rev4 Rule equivalent 4.5
2+
export default {
3+
id: 'aws-cis-1.5.0-2.1.1',
4+
title: 'AWS CIS 2.1.1 Ensure all S3 buckets employ encryption-at-rest',
5+
6+
description: 'Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.',
7+
8+
audit: `**From Console:**
9+
10+
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
11+
2. Select the Check box next to the Bucket.
12+
3. Click on 'Properties'.
13+
4. Verify that Default Encryption displays either AES-256 or AWS-KMS.
14+
5. Repeat for all the buckets in your AWS account.
15+
16+
**From Command Line:**
17+
18+
1. Run command to list buckets
19+
20+
aws s3 ls
21+
22+
2. For each bucket, run
23+
24+
aws s3api get-bucket-encryption --bucket <bucket name>
25+
26+
3. Verify that either
27+
28+
"SSEAlgorithm": "AES256"
29+
30+
or
31+
32+
"SSEAlgorithm": "aws:kms" is displayed.`,
33+
34+
rationale: 'Encrypting data at rest reduces the likelihood that it is unintentionally exposed and can nullify the impact of disclosure if the encryption remains unbroken.',
35+
36+
remediation: `**From Console:**
37+
38+
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
39+
2. Select the Check box next to the Bucket.
40+
3. Click on 'Properties'.
41+
4. Click on Default Encryption.
42+
5. Select either AES-256 or AWS-KMS
43+
6. Click Save
44+
7. Repeat for all the buckets in your AWS account lacking encryption.
45+
46+
**From Command Line:**
47+
48+
Run either
49+
50+
aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'
51+
52+
or
53+
54+
aws s3api put-bucket-encryption --bucket <bucket name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms","KMSMasterKeyID": "aws/s3"}}]}'
55+
56+
**Note:** the KMSMasterKeyID can be set to the master key of your choosing; aws/s3 is an AWS preconfigured default.`,
57+
58+
references: [
59+
'https://docs.aws.amazon.com/AmazonS3/latest/user-guide/default-bucket-encryption.html',
60+
'https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html#bucket-encryption-related-resources',
61+
],
62+
gql: `{
63+
queryawsS3 {
64+
id
65+
arn
66+
accountId
67+
__typename
68+
encrypted
69+
encryptionRules {
70+
sseAlgorithm
71+
}
72+
}
73+
}`,
74+
resource: 'queryawsS3[*]',
75+
severity: 'high',
76+
conditions: {
77+
and: [
78+
{
79+
path: '@.encrypted',
80+
equal: 'Yes',
81+
},
82+
{
83+
path: '@.encryptionRules',
84+
array_any: {
85+
path: '[*].sseAlgorithm',
86+
in: ['AES256', 'aws:kms'],
87+
},
88+
},
89+
],
90+
},
91+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-2.1.2.ts‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-2.1.2',
3+
title: 'AWS CIS 2.1.2 Ensure S3 Bucket Policy is set to deny HTTP requests',
4+
5+
description: 'At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.',
6+
7+
audit: `To allow access to HTTPS you can use a condition that checks for the key "aws:SecureTransport: true". This means that the request is sent through HTTPS but that HTTP can still be used. So to make sure you do not allow HTTP access confirm that there is a bucket policy that explicitly denies access for HTTP requests and that it contains the key "aws:SecureTransport": "false".
8+
9+
**From Console:**
10+
11+
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
12+
2. Select the Check box next to the Bucket.
13+
3. Click on 'Permissions', then Click on Bucket Policy.
14+
4. Ensure that a policy is listed that matches:
15+
16+
{
17+
"Sid": <optional>,
18+
"Effect": "Deny",
19+
"Principal": "*",
20+
"Action": "s3:GetObject",
21+
"Resource": "arn:aws:s3:::<bucket_name>/*",
22+
"Condition": {
23+
"Bool": {
24+
"aws:SecureTransport": "false"
25+
}
26+
}
27+
}
28+
29+
<optional> and <bucket_name> will be specific to your account
30+
31+
5. Repeat for all the buckets in your AWS account.
32+
33+
**From Command Line:**
34+
35+
1. List all of the S3 Buckets
36+
37+
aws s3 ls
38+
39+
2. Using the list of buckets run this command on each of them:
40+
41+
aws s3api get-bucket-policy --bucket <bucket_name> | grep aws:SecureTransport
42+
43+
3. Confirm that aws:SecureTransport is set to false aws:SecureTransport:false
44+
4. Confirm that the policy line has Effect set to Deny 'Effect:Deny'`,
45+
46+
rationale: 'By default, Amazon S3 allows both HTTP and HTTPS requests. To achieve only allowing access to Amazon S3 objects through HTTPS you also have to explicitly deny access to HTTP requests. Bucket policies that allow HTTPS requests without explicitly denying HTTP requests will not comply with this recommendation.',
47+
48+
remediation: `**From Console:**
49+
50+
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
51+
2. Select the Check box next to the Bucket.
52+
3. Click on 'Permissions'.
53+
4. Click 'Bucket Policy'
54+
5. Add this to the existing policy filling in the required information
55+
56+
{
57+
"Sid": <optional>,
58+
"Effect": "Deny",
59+
"Principal": "*",
60+
"Action": "s3:GetObject",
61+
"Resource": "arn:aws:s3:::<bucket_name>/*",
62+
"Condition": {
63+
"Bool": {
64+
"aws:SecureTransport": "false"
65+
}
66+
}
67+
}
68+
69+
6. Save
70+
7. Repeat for all the buckets in your AWS account that contain sensitive data.
71+
72+
**From Console**
73+
using AWS Policy Generator:
74+
75+
1. Repeat steps 1-4 above.
76+
2. Click on Policy Generator at the bottom of the Bucket Policy Editor
77+
3. Select Policy Type S3 Bucket Policy
78+
4. Add Statements
79+
Effect = Deny
80+
Principal = *
81+
AWS Service = Amazon S3
82+
Actions = GetObject
83+
Amazon Resource Name =
84+
5. Generate Policy
85+
6. Copy the text and add it to the Bucket Policy.
86+
87+
**From Command Line:**
88+
89+
1. Export the bucket policy to a json file.
90+
91+
aws s3api get-bucket-policy --bucket <bucket_name> --query Policy --output text > policy.json
92+
93+
2. Modify the policy.json file by adding in this statement:
94+
95+
{
96+
"Sid": <optional>,
97+
"Effect": "Deny",
98+
"Principal": "*",
99+
"Action": "s3:GetObject",
100+
"Resource": "arn:aws:s3:::<bucket_name>/*",
101+
"Condition": {
102+
"Bool": {
103+
"aws:SecureTransport": "false"
104+
}
105+
}
106+
}
107+
108+
3. Apply this modified policy back to the S3 bucket:
109+
110+
aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json`,
111+
112+
references: [
113+
'https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/',
114+
'https://aws.amazon.com/blogs/security/how-to-use-bucket-policies-and-apply-defense-in-depth-to-help-secure-your-amazon-s3-data/',
115+
'https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-policy.html',
116+
],
117+
118+
severity: 'medium',
119+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-2.1.3.ts‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-2.1.3',
3+
title: 'AWS CIS 2.1.3 Ensure MFA Delete is enable on S3 buckets',
4+
5+
description: 'Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.',
6+
7+
audit: `Perform the steps below to confirm MFA delete is configured on an S3 Bucket
8+
9+
**From Console:**
10+
11+
1. Login to the S3 console at https://console.aws.amazon.com/s3/
12+
2. Click the _Check_ box next to the Bucket name you want to confirm
13+
3. In the window under _Properties_
14+
4. Confirm that Versioning is _Enabled_
15+
5. Confirm that MFA Delete is _Enabled_
16+
17+
**From Command Line:**
18+
19+
1. Run the get-bucket-versioning
20+
21+
aws s3api get-bucket-versioning --bucket my-bucket
22+
23+
Output example:
24+
25+
<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
26+
<Status>Enabled</Status>
27+
<MfaDelete>Enabled</MfaDelete>
28+
</VersioningConfiguration>
29+
30+
If the Console or the CLI output does not show Versioning and MFA Delete enabled refer to the remediation below.`,
31+
32+
rationale: 'Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.',
33+
34+
remediation: `Perform the steps below to enable MFA delete on an S3 bucket.
35+
Note:
36+
-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.
37+
-You must use your 'root' account to enable MFA Delete on S3 buckets.
38+
39+
**From Command line:**
40+
41+
1. Run the s3api put-bucket-versioning command
42+
43+
aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled`,
44+
45+
references: [
46+
'https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete',
47+
'https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html',
48+
'https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/',
49+
'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html',
50+
],
51+
gql: `{
52+
queryawsS3 {
53+
id
54+
arn
55+
accountId
56+
__typename
57+
versioning
58+
mfa
59+
}
60+
}`,
61+
resource: 'queryawsS3[*]',
62+
severity: 'high',
63+
conditions: {
64+
and: [
65+
{
66+
path: '@.versioning',
67+
equal: 'Enabled',
68+
},
69+
{
70+
path: '@.mfa',
71+
equal: 'Enabled',
72+
},
73+
],
74+
},
75+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-2.1.4.ts‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-2.1.4',
3+
title: 'AWS CIS 2.1.4 Ensure all data in Amazon S3 has been discovered, classified and secured when required',
4+
5+
description: 'Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.',
6+
7+
audit: `Perform the following steps to determine if Macie is running:
8+
9+
**From Console:**
10+
11+
1. Login to the Macie console at https://console.aws.amazon.com/macie/
12+
13+
2. In the left hand pane click on By job under findings.
14+
15+
3. Confirm that you have a Job setup for your S3 Buckets
16+
17+
When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.`,
18+
19+
rationale: `Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.
20+
21+
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.`,
22+
23+
remediation: `Perform the steps below to enable and configure Amazon Macie
24+
25+
**From Console:**
26+
27+
1. Log on to the Macie console at https://console.aws.amazon.com/macie/
28+
2. Click Get started.
29+
3. Click Enable Macie.
30+
31+
Setup a repository for sensitive data discovery results
32+
33+
1. In the Left pane, under Settings, click Discovery results.
34+
2. Make sure Create bucket is selected.
35+
3. Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.
36+
4. Click on Advanced.
37+
5. Block all public access, make sure Yes is selected.
38+
6. KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.
39+
7. Click on Save
40+
41+
Create a job to discover sensitive data
42+
43+
1. In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.
44+
2. Select the check box for each bucket that you want Macie to analyze as part of the job
45+
3. Click Create job.
46+
4. Click Quick create.
47+
5. For the Name and description step, enter a name and, optionally, a description of the job.
48+
6. Then click Next.
49+
7. For the Review and create step, click Submit.
50+
51+
Review your findings
52+
53+
1. In the left pane, click Findings.
54+
2. To view the details of a specific finding, choose any field other than the check box for the finding.
55+
56+
If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.`,
57+
58+
references: [
59+
'https://aws.amazon.com/macie/getting-started/',
60+
'https://docs.aws.amazon.com/workspaces/latest/adminguide/data-protection.html',
61+
'https://docs.aws.amazon.com/macie/latest/user/data-classification.html',
62+
],
63+
64+
severity: 'high',
65+
}

0 commit comments

Comments
 (0)