Rule: S3 Public Access Blocked at Bucket Levels
This rule ensures blocking public access in S3 buckets to enhance security measures.
| Rule | S3 public access should be blocked at bucket levels |
| Framework | FedRAMP Moderate Revision 4 |
| Severity | ✔ High |
Rule Description
This rule ensures that public access to S3 buckets is blocked at the bucket level in compliance with the FedRAMP Moderate Revision 4 requirements. By enforcing this rule, you reduce the risk of unauthorized access to sensitive data stored in your AWS S3 buckets.
Troubleshooting Steps
Troubleshooting steps may vary depending on the specific implementation and configuration of your S3 buckets. However, here are some general steps you can take:
- 1.
Check Bucket Permissions: Review the access control list (ACL) and bucket policies for each S3 bucket to ensure there are no permissions allowing public access.
- 2.
Audit Bucket Policies: Analyze the existing bucket policies to identify any statements that grant public access and make necessary modifications to restrict access accordingly.
- 3.
Review Bucket CORS Configurations: Cross-Origin Resource Sharing (CORS) configurations can also impact S3 bucket access. Check if your bucket has CORS configurations that might allow public access.
- 4.
Analyze Access Logs: Enable S3 access logs and analyze them to determine if any unauthorized access attempts have been made. If identified, investigate the cause and take appropriate actions.
Necessary Codes
No specific codes are required for this rule. However, you can utilize the AWS Command Line Interface (CLI) to inspect bucket permissions, policies, and configurations if troubleshooting is needed.
Step-by-Step Guide to Remedy
To block public access at the bucket level for S3 in compliance with FedRAMP Moderate Revision 4, follow these steps:
- 1.
Open the AWS Management Console and navigate to the S3 service.
- 2.
Select the bucket for which you want to block public access.
- 3.
Click on the "Permissions" tab.
- 4.
Check the access control list (ACL) for the bucket and ensure there are no permissions allowing public access. Remove any public permissions if found.
- 5.
Click on the "Access points" tab, if utilized, and verify that public access is disabled for all access points associated with the bucket.
- 6.
Review the bucket policies by clicking on the "Bucket policy" option under "Permissions". Ensure that there are no statements allowing public access.
- 7.
If required, modify the bucket policy to restrict access and remove any statements allowing public access. Refer to the AWS S3 documentation for guidance on writing and modifying bucket policies.
- 8.
Analyze the CORS configuration by clicking on the "Cross-origin Resource Sharing (CORS)" option under "Permissions". Ensure that there are no configurations allowing public access.
- 9.
Modify the CORS configuration if necessary to restrict access to authorized origins only.
- 10.
Enable S3 access logging for the bucket, if not already enabled. This will help in monitoring and identifying any unauthorized access attempts in the future.
- 11.
Periodically review the bucket permissions, policies, and configurations to ensure that no changes have been made that could allow public access.
Following these steps will help you block public access at the bucket level for your S3 buckets, ensuring compliance with FedRAMP Moderate Revision 4 requirements.