Rule: S3 Buckets Should Enforce SSL

Rule Description

Troubleshooting Steps

2. 1.
   Verify SSL support: Ensure that the target S3 bucket supports SSL encryption. Some older buckets may not have SSL encryption capabilities, so consider creating a new bucket if necessary.
4. 2.
   Check endpoint settings: Confirm that the S3 bucket's endpoint is configured to use SSL. This can be verified in the Amazon S3 bucket properties.
6. 3.
   Review IAM policies: Ensure that the IAM (Identity and Access Management) policies associated with the S3 bucket do not restrict SSL usage. Inspect the policy to confirm that SSL (HTTPS) access is allowed.
8. 4.
   Verify SSL certificate: If you are using a custom domain with SSL, ensure that the SSL certificate is valid and correctly set up.
10. 5.
    Check SSL-related settings: Review any SSL-related settings that might be present in the S3 bucket configuration. Ensure that SSL is enabled and configured correctly.

Necessary Codes

aws s3api put-bucket-policy --bucket YOUR_BUCKET_NAME --policy '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EnforceSSLAccess",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::YOUR_BUCKET_NAME/*",
                "arn:aws:s3:::YOUR_BUCKET_NAME"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}'

Step-by-Step Guide for Remediation

2. 1.
   Open your terminal or command prompt.
4. 2.
   Install and configure the AWS CLI if not already done.
6. 3.
   Run the following command, replacing

   YOUR_BUCKET_NAME

   with the actual name of your S3 bucket:

   aws s3api put-bucket-policy --bucket YOUR_BUCKET_NAME --policy '{
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "EnforceSSLAccess",
               "Effect": "Deny",
               "Principal": "*",
               "Action": "s3:*",
               "Resource": [
                   "arn:aws:s3:::YOUR_BUCKET_NAME/*",
                   "arn:aws:s3:::YOUR_BUCKET_NAME"
               ],
               "Condition": {
                   "Bool": {
                       "aws:SecureTransport": "false"
                   }
               }
           }
       ]
   }'
   

8. 4.
   After executing the command, the SSL enforcement policy will be applied to the specified S3 bucket.