Rule: S3 Buckets should prohibit public read access

Rule Description

Troubleshooting Steps

2. 1.
   Identify the affected S3 bucket(s) that have public read access enabled.
4. 2.
   Review the permissions and policies associated with the S3 bucket to determine where the public read access is being granted.
6. 3.
   Make sure that all policies and ACLs (Access Control Lists) are properly configured to restrict public access.
8. 4.
   Check for any misconfigured IAM (Identity and Access Management) policies or roles that are allowing public read access.
10. 5.
    Review any bucket policies or bucket ACLs that may be granting public read access.
12. 6.
    Ensure that any associated data or objects within the bucket do not have public read permissions.
14. 7.
    Test the access controls by attempting to access the bucket from an unauthorized account or user to confirm that public read access is properly restricted.

Necessary Codes

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPublicRead",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::your-bucket-name/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpce": "vpce-your-vpce-id"
                }
            }
        }
    ]
}

Step-by-Step Guide for Remediation

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the Amazon S3 service.
6. 3.
   Locate the S3 bucket that needs to have public read access disabled.
8. 4.
   Click on the bucket name to access its details.
10. 5.
    In the bucket details, go to the "Permissions" tab.
12. 6.
    Under "Bucket Policy", click on "Edit" to update the policy.
14. 7.
    Replace the existing bucket policy with the code mentioned above, ensuring that you replace "your-bucket-name" and "vpce-your-vpce-id" with the appropriate values.
16. 8.
    Click on "Save changes" to apply the new bucket policy.
18. 9.
    Verify that public read access has been disabled by attempting to access the bucket using a non-privileged user or account.
20. 10.
    Repeat these steps for any other S3 buckets that require the same remediation.