Rule: S3 Buckets should Prohibit Public Write Access

Rule Description: S3 buckets should prohibit public write access for FedRAMP Low Revision 4

Troubleshooting Steps (if necessary):

2. 1.
   Check if the S3 bucket policy allows public write access.
4. 2.
   Determine if any IAM policies or access control lists (ACLs) grant public write access to the S3 bucket.
6. 3.
   Review the configuration history to identify any recent changes that may have introduced public write access.

Necessary Code (if necessary):

Bucket Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPublicWriteAccess",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::your-bucket/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

IAM Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPublicWriteAccess",
            "Effect": "Deny",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::your-bucket/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

Remediation Steps:

2. 1.
   Identify the S3 bucket that needs to be modified.
4. 2.
   Confirm your identity and permissions to modify the S3 bucket.
6. 3.
   Access the AWS Management Console or use the AWS CLI with appropriate credentials.

AWS Management Console:

2. 1.
   Navigate to the S3 service.
4. 2.
   Find and select the target S3 bucket that violates the rule.
6. 3.
   Click on the "Permissions" tab.
8. 4.
   Review the existing bucket policy, IAM policies, and ACLs associated with the bucket.
10. 5.
    If a bucket policy exists and permits public write access, click on the "Edit" button next to "Bucket policy" and replace the existing policy with the necessary code provided above.
12. 6.
    If IAM policies or ACLs are granting public write access, navigate to the "Access Control List" and "User policies" sections, and modify them as per the necessary code provided above.
14. 7.
    Click on "Save changes" or similar option to apply the changes.

AWS CLI:

2. 1.
   Open the AWS CLI or Terminal.
4. 2.
   Run the following command to update the bucket policy:

aws s3api put-bucket-policy --bucket your-bucket --policy file://bucket-policy.json

your-bucket

2. 1.
   Run the following command to modify the IAM policy:

aws s3api put-bucket-acl --bucket your-bucket --acl public-read-write --grant-read uri=http://acs.amazonaws.com/groups/global/AllUsers

your-bucket