Skip to content

Commit 6cb7d67

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #127 from cloudgraphdev/fix/CG-1328-aws-cis-140-215
fix(CG-1328): fix the AWS CIS 1.4.0 2.1.5 rule
2 parents 9949f41 + 88e60c4 commit 6cb7d67

5 files changed

Lines changed: 224 additions & 80 deletions

File tree

‎src/aws/cis-1.4.0/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,8 @@ Policy Pack based on the [AWS Foundations 1.4.0](https://docs.aws.amazon.com/aud
8282
| AWS CIS 2.1.2 | Ensure S3 Bucket Policy allows HTTPS requests |
8383
| AWS CIS 2.1.3 | Ensure MFA Delete is enable on S3 buckets |
8484
| AWS CIS 2.1.4 | Ensure all data in Amazon S3 has been discovered, classified and secured when required. |
85-
| AWS CIS 2.1.5 | Ensure that S3 Buckets are configured with 'Block public access (bucket settings)' |
85+
| AWS CIS 2.1.5.1 | Ensure that S3 Buckets are configured with 'Block public access (account settings)' |
86+
| AWS CIS 2.1.5.2 | Ensure that S3 Buckets are configured with 'Block public access (bucket settings)' |
8687
| AWS CIS 2.2.1 | Ensure EBS volume encryption is enabled |
8788
| AWS CIS 2.3.1 | Ensure that encryption is enabled for RDS Instances |
8889
| AWS CIS 3.1 | Ensure CloudTrail is enabled in all regions |

src/aws/cis-1.4.0/rules/aws-cis-1.4.0-2.1.5.ts renamed to src/aws/cis-1.4.0/rules/aws-cis-1.4.0-2.1.5.1.ts

Lines changed: 19 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,10 @@
11
export default {
2-
id: 'aws-cis-1.4.0-2.1.5',
3-
title: 'AWS CIS 2.1.5 Ensure that S3 Buckets are configured with \'Block public access (bucket settings)\'',
2+
id: 'aws-cis-1.4.0-2.1.5.1',
3+
title: 'AWS CIS 2.1.5.1 Ensure that S3 Buckets are configured with \'Block public access (bucket settings)\' (account settings)',
44

55
description: 'Amazon S3 provides Block public access (bucket settings) and Block public access (account settings) to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, Block public access (bucket settings) prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, Block public access (account settings) prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.',
66

7-
audit: `**If utilizing Block Public Access (bucket settings)**
8-
**From Console:**
9-
10-
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
11-
2. Select the Check box next to the Bucket.
12-
3. Click on 'Edit public access settings'.
13-
4. Ensure that block public access settings are set appropriately for this bucket
14-
5. Repeat for all the buckets in your AWS account.
15-
16-
**From Command Line:**
17-
18-
1. List all of the S3 Buckets
19-
20-
aws s3 ls
21-
22-
2. Find the public access setting on that bucket
23-
24-
aws s3api get-public-access-block --bucket <name-of-the-bucket>
25-
26-
Output if Block Public access is enabled:
27-
28-
{
29-
"PublicAccessBlockConfiguration": {
30-
"BlockPublicAcls": true,
31-
"IgnorePublicAcls": true,
32-
"BlockPublicPolicy": true,
33-
"RestrictPublicBuckets": true
34-
}
35-
}
36-
37-
If the output reads false for the separate configuration settings then proceed to the remediation.
38-
39-
**If utilizing Block Public Access (account settings)**
40-
**From Console:**
7+
audit: `**From Console:**
418
429
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
4310
2. Choose Block public access (account settings)
@@ -61,33 +28,11 @@ export default {
6128
6229
If the output reads *false* for the separate configuration settings then proceed to the remediation.`,
6330

64-
rationale: `Amazon S3 Block public access (bucket settings) prevents the accidental or malicious public exposure of data contained within the respective bucket(s).
65-
66-
Amazon S3 Block public access (account settings) prevents the accidental or malicious public exposure of data contained within all buckets of the respective AWS account.
31+
rationale: `Amazon S3 'Block public access (account settings)' prevents the accidental or malicious public exposure of data contained within all buckets of the respective AWS account.
6732
6833
Whether blocking public access to all or some buckets is an organizational decision that should be based on data sensitivity, least privilege, and use case.`,
6934

70-
remediation: `**If utilizing Block Public Access (bucket settings)**
71-
**From Console:**
72-
73-
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
74-
2. Select the Check box next to the Bucket.
75-
3. Click on 'Edit public access settings'.
76-
4. Click 'Block all public access'
77-
5. Repeat for all the buckets in your AWS account that contain sensitive data.
78-
79-
**From Command Line:**
80-
81-
1. List all of the S3 Buckets
82-
83-
aws s3 ls
84-
85-
2. Set the Block Public Access to true on that bucket
86-
87-
aws s3api put-public-access-block --bucket <name-of-bucket> --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
88-
89-
**If utilizing Block Public Access (account settings)**
90-
**From Console:**
35+
remediation: `**From Console:**
9136
If the output reads *true* for the separate configuration settings then it is set on the account.
9237
9338
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
@@ -104,34 +49,34 @@ export default {
10449
references: ['https://docs.aws.amazon.com/AmazonS3/latest/user-guide/block-public-access-account.html'],
10550
gql: `{
10651
queryawsS3 {
107-
id
108-
arn
109-
accountId
110-
__typename
111-
blockPublicAcls
112-
ignorePublicAcls
113-
blockPublicPolicy
114-
restrictPublicBuckets
115-
}
116-
}`,
52+
id
53+
arn
54+
accountId
55+
__typename
56+
accountLevelBlockPublicAcls
57+
accountLevelIgnorePublicAcls
58+
accountLevelBlockPublicPolicy
59+
accountLevelRestrictPublicBuckets
60+
}
61+
}`,
11762
resource: 'queryawsS3[*]',
11863
severity: 'high',
11964
conditions: {
12065
and: [
12166
{
122-
path: '@.blockPublicAcls',
67+
path: '@.accountLevelBlockPublicAcls',
12368
equal: 'Yes',
12469
},
12570
{
126-
path: '@.ignorePublicAcls',
71+
path: '@.accountLevelIgnorePublicAcls',
12772
equal: 'Yes',
12873
},
12974
{
130-
path: '@.blockPublicPolicy',
75+
path: '@.accountLevelBlockPublicPolicy',
13176
equal: 'Yes',
13277
},
13378
{
134-
path: '@.restrictPublicBuckets',
79+
path: '@.accountLevelRestrictPublicBuckets',
13580
equal: 'Yes',
13681
},
13782
],

‎src/aws/cis-1.4.0/rules/aws-cis-1.4.0-2.1.5.2.ts‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
export default {
2+
id: 'aws-cis-1.4.0-2.1.5.2',
3+
title: 'AWS CIS 2.1.5.2 Ensure that S3 Buckets are configured with \'Block public access (bucket settings)\' (bucket settings)',
4+
5+
description: 'Amazon S3 provides Block public access (bucket settings) and Block public access (account settings) to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, Block public access (bucket settings) prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, Block public access (account settings) prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.',
6+
7+
audit: `**From Console:**
8+
9+
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
10+
2. Select the Check box next to the Bucket.
11+
3. Click on 'Edit public access settings'.
12+
4. Ensure that block public access settings are set appropriately for this bucket
13+
5. Repeat for all the buckets in your AWS account.
14+
15+
**From Command Line:**
16+
17+
1. List all of the S3 Buckets
18+
19+
aws s3 ls
20+
21+
2. Find the public access setting on that bucket
22+
23+
aws s3api get-public-access-block --bucket <name-of-the-bucket>
24+
25+
Output if Block Public access is enabled:
26+
27+
{
28+
"PublicAccessBlockConfiguration": {
29+
"BlockPublicAcls": true,
30+
"IgnorePublicAcls": true,
31+
"BlockPublicPolicy": true,
32+
"RestrictPublicBuckets": true
33+
}
34+
}
35+
36+
If the output reads false for the separate configuration settings then proceed to the remediation.`,
37+
38+
rationale: `Amazon S3 'Block public access (bucket settings)' prevents the accidental or malicious public exposure of data contained within the respective bucket(s).
39+
40+
Whether blocking public access to all or some buckets is an organizational decision that should be based on data sensitivity, least privilege, and use case.`,
41+
42+
remediation: `**From Console:**
43+
44+
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
45+
2. Select the Check box next to the Bucket.
46+
3. Click on 'Edit public access settings'.
47+
4. Click 'Block all public access'
48+
5. Repeat for all the buckets in your AWS account that contain sensitive data.
49+
50+
**From Command Line:**
51+
52+
1. List all of the S3 Buckets
53+
54+
aws s3 ls
55+
56+
2. Set the Block Public Access to true on that bucket
57+
58+
aws s3api put-public-access-block --bucket <name-of-bucket> --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"`,
59+
60+
references: ['https://docs.aws.amazon.com/AmazonS3/latest/user-guide/block-public-access-account.html'],
61+
gql: `{
62+
queryawsS3 {
63+
id
64+
arn
65+
accountId
66+
__typename
67+
blockPublicAcls
68+
ignorePublicAcls
69+
blockPublicPolicy
70+
restrictPublicBuckets
71+
}
72+
}`,
73+
resource: 'queryawsS3[*]',
74+
severity: 'high',
75+
conditions: {
76+
and: [
77+
{
78+
path: '@.blockPublicAcls',
79+
equal: 'Yes',
80+
},
81+
{
82+
path: '@.ignorePublicAcls',
83+
equal: 'Yes',
84+
},
85+
{
86+
path: '@.blockPublicPolicy',
87+
equal: 'Yes',
88+
},
89+
{
90+
path: '@.restrictPublicBuckets',
91+
equal: 'Yes',
92+
},
93+
],
94+
},
95+
}

‎src/aws/cis-1.4.0/rules/index.ts‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ import Aws_CIS_140_211 from './aws-cis-1.4.0-2.1.1'
2323
import Aws_CIS_140_212 from './aws-cis-1.4.0-2.1.2'
2424
import Aws_CIS_140_213 from './aws-cis-1.4.0-2.1.3'
2525
import Aws_CIS_140_214 from './aws-cis-1.4.0-2.1.4'
26-
import Aws_CIS_140_215 from './aws-cis-1.4.0-2.1.5'
26+
import Aws_CIS_140_215_1 from './aws-cis-1.4.0-2.1.5.1'
27+
import Aws_CIS_140_215_2 from './aws-cis-1.4.0-2.1.5.2'
2728
import Aws_CIS_140_221 from './aws-cis-1.4.0-2.2.1'
2829
import Aws_CIS_140_231 from './aws-cis-1.4.0-2.3.1'
2930
import Aws_CIS_140_31 from './aws-cis-1.4.0-3.1'
@@ -83,7 +84,8 @@ export default [
8384
Aws_CIS_140_212,
8485
Aws_CIS_140_213,
8586
Aws_CIS_140_214,
86-
Aws_CIS_140_215,
87+
Aws_CIS_140_215_1,
88+
Aws_CIS_140_215_2,
8789
Aws_CIS_140_221,
8890
Aws_CIS_140_231,
8991
Aws_CIS_140_31,

‎src/aws/cis-1.4.0/tests/aws-cis-1.4.0-2.x.test.ts‎

Lines changed: 104 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ import { initRuleEngine } from '../../../utils/test'
55
import Aws_CIS_140_211 from '../rules/aws-cis-1.4.0-2.1.1'
66
import Aws_CIS_140_212 from '../rules/aws-cis-1.4.0-2.1.2'
77
import Aws_CIS_140_213 from '../rules/aws-cis-1.4.0-2.1.3'
8-
import Aws_CIS_140_215 from '../rules/aws-cis-1.4.0-2.1.5'
8+
import Aws_CIS_140_215_1 from '../rules/aws-cis-1.4.0-2.1.5.1'
9+
import Aws_CIS_140_215_2 from '../rules/aws-cis-1.4.0-2.1.5.2'
910
import Aws_CIS_140_231 from '../rules/aws-cis-1.4.0-2.3.1'
1011

1112
export interface Condition {
@@ -46,6 +47,10 @@ export interface QueryawsS3 {
4647
ignorePublicAcls?: string
4748
blockPublicPolicy?: string
4849
restrictPublicBuckets?: string
50+
accountLevelBlockPublicAcls?: string,
51+
accountLevelIgnorePublicAcls?: string,
52+
accountLevelBlockPublicPolicy?: string,
53+
accountLevelRestrictPublicBuckets?: string
4954
encrypted?: string
5055
encryptionRules?: EncryptionRule[]
5156
}
@@ -262,7 +267,103 @@ describe('CIS Amazon Web Services Foundations: 1.4.0', () => {
262267
})
263268
})
264269

265-
describe('AWS CIS 2.1.5 Ensure that S3 Buckets are configured with Block public access (bucket settings)', () => {
270+
describe('AWS CIS 2.1.5.1 Ensure that S3 Buckets are configured with Block public access (account settings)', () => {
271+
const getTestRuleFixture = (
272+
accountLevelBlockPublicAcls: string,
273+
accountLevelIgnorePublicAcls: string,
274+
accountLevelBlockPublicPolicy: string,
275+
accountLevelRestrictPublicBuckets: string,
276+
): CIS2xQueryResponse => {
277+
return {
278+
queryawsS3: [
279+
{
280+
id: cuid(),
281+
accountLevelBlockPublicAcls,
282+
accountLevelIgnorePublicAcls,
283+
accountLevelBlockPublicPolicy,
284+
accountLevelRestrictPublicBuckets,
285+
},
286+
],
287+
}
288+
}
289+
290+
// Act
291+
const testRule = async (
292+
data: CIS2xQueryResponse,
293+
expectedResult: Result
294+
): Promise<void> => {
295+
// Act
296+
const [processedRule] = await rulesEngine.processRule(
297+
Aws_CIS_140_215_1 as Rule,
298+
{ ...data }
299+
)
300+
301+
// Asserts
302+
expect(processedRule.result).toBe(expectedResult)
303+
}
304+
305+
test('No Security Issue when S3 Account Level is configured with Block public access', async () => {
306+
const data: CIS2xQueryResponse = getTestRuleFixture(
307+
'Yes',
308+
'Yes',
309+
'Yes',
310+
'Yes'
311+
)
312+
await testRule(data, Result.PASS)
313+
})
314+
315+
test('Security Issue when S3 Account Level is not configured with Block public access', async () => {
316+
const data: CIS2xQueryResponse = getTestRuleFixture(
317+
'No',
318+
'No',
319+
'No',
320+
'No'
321+
)
322+
await testRule(data, Result.FAIL)
323+
})
324+
325+
test('Security Issue when S3 Account Level have a Block public access with blockPublicAcls set to No', async () => {
326+
const data: CIS2xQueryResponse = getTestRuleFixture(
327+
'No',
328+
'Yes',
329+
'Yes',
330+
'Yes'
331+
)
332+
await testRule(data, Result.FAIL)
333+
})
334+
335+
test('Security Issue when S3 Account Level have a Block public access with ignorePublicAcls set to No', async () => {
336+
const data: CIS2xQueryResponse = getTestRuleFixture(
337+
'Yes',
338+
'No',
339+
'Yes',
340+
'Yes'
341+
)
342+
await testRule(data, Result.FAIL)
343+
})
344+
345+
test('Security Issue when S3 Account Level have a Block public access with blockPublicPolicy set to No', async () => {
346+
const data: CIS2xQueryResponse = getTestRuleFixture(
347+
'Yes',
348+
'Yes',
349+
'No',
350+
'Yes'
351+
)
352+
await testRule(data, Result.FAIL)
353+
})
354+
355+
test('Security Issue when S3 Account Level have a Block public access with restrictPublicBuckets set to No', async () => {
356+
const data: CIS2xQueryResponse = getTestRuleFixture(
357+
'Yes',
358+
'Yes',
359+
'Yes',
360+
'No'
361+
)
362+
await testRule(data, Result.FAIL)
363+
})
364+
})
365+
366+
describe('AWS CIS 2.1.5.2 Ensure that S3 Buckets are configured with Block public access (bucket settings)', () => {
266367
const getTestRuleFixture = (
267368
blockPublicAcls: string,
268369
ignorePublicAcls: string,
@@ -289,7 +390,7 @@ describe('CIS Amazon Web Services Foundations: 1.4.0', () => {
289390
): Promise<void> => {
290391
// Act
291392
const [processedRule] = await rulesEngine.processRule(
292-
Aws_CIS_140_215 as Rule,
393+
Aws_CIS_140_215_2 as Rule,
293394
{ ...data }
294395
)
295396

0 commit comments

Comments
 (0)