Rule: S3 Buckets should enforce SSL

Rule/Policy Description:

Steps for Troubleshooting (if applicable):

2. 1.
   Data transfer to and from the S3 bucket may be vulnerable to interception.
4. 2.
   Non-compliance with FedRAMP Low Revision 4 security requirements.
6. 3.
   Audit findings and potential regulatory non-compliance.

2. 1.
   Verify that SSL is enabled on the target S3 bucket.
4. 2.
   Review the bucket's access policies to ensure SSL-only access is enforced.
6. 3.
   Check if the bucket policy restricts access to SSL connections only.
8. 4.
   Test the bucket by attempting to access it without SSL to see if the expected enforcement is in place.
10. 5.
    Review the CloudTrail logs for any SSL-related errors or warnings.

Necessary Codes (if applicable):

{
    "Version": "2012-10-17",
    "Id": "EnforceSSLOnly",
    "Statement": [
        {
            "Sid": "ForceSSLOnlyAccess",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::your-bucket-name/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

Step-by-Step Guide for Remediation:

2. 1.
   Identify the target S3 bucket that needs SSL enforcement.
4. 2.
   Open the AWS Management Console and navigate to the S3 service.
6. 3.
   Locate the target bucket in the list and select it.
8. 4.
   Click on the "Permissions" tab.
10. 5.
    Under "Bucket Policy," click on the "Edit" button.
12. 6.
    Replace any existing bucket policy with the code snippet provided above.
14. 7.
    Update the 'Resource' field in the code snippet to reflect the bucket's ARN.
16. 8.
    Click on the "Save changes" button to apply the updated bucket policy.
18. 9.
    Test the SSL enforcement by attempting to access the bucket without SSL (e.g., using an HTTP URL).
20. 10.
    Access to the bucket should now be denied, and an SSL connection should be required.