Rule: S3 Buckets Should Prohibit Public Read Access

Rule Description:

Troubleshooting Steps:

2. 1.
   Identify the S3 buckets that have public read access.
4. 2.
   Review the bucket policies and access control lists (ACLs) for each bucket.
6. 3.
   Analyze the IAM policies attached to users, groups, and roles that interact with the buckets.
8. 4.
   Check if any third-party applications or services have permissions to access the buckets.

Code Example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPublicRead",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::EXAMPLE-BUCKET/*",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalType": "Anonymous"
                }
            }
        }
    ]
}

Remediation Steps:

2. 1.
   Identify the S3 bucket that needs to have public read access prohibited.
4. 2.
   Open the Amazon S3 management console.
6. 3.
   Navigate to the bucket that needs to be updated.
8. 4.
   Select the "Permissions" tab.
10. 5.
    In the "Bucket Policy" section, click on "Edit".
12. 6.
    Replace any existing bucket policy with the code example provided above.
14. 7.
    Click on "Save" to apply the new bucket policy.

2. 1.
   Open the terminal or command prompt.
4. 2.
   Run the following command, replacing "EXAMPLE-BUCKET" with your bucket name:

aws s3api put-bucket-policy --bucket EXAMPLE-BUCKET --policy '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPublicRead",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::EXAMPLE-BUCKET/*",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalType": "Anonymous"
                }
            }
        }
    ]
}'

2. 1.
   Verify that the bucket policy was applied successfully by checking the S3 bucket's permissions in the management console.