Rule: S3 Public Access Blocked at Account Level

Description of the Rule

Troubleshooting Steps

2. 1.
   Check the current access settings of S3 buckets in the AWS account.
4. 2.
   Verify that no S3 buckets have public access permissions enabled.
6. 3.
   Review the IAM policies and roles associated with S3 buckets to ensure there are no misconfigurations.

Necessary Code

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "s3:*",
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            },
            "Principal": "*"
        }
    ]
}

Step-by-Step Guide for Remediation

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Go to the IAM service.
6. 3.
   Click on "Policies" in the left navigation pane and then click on the "Create policy" button.
8. 4.
   Choose the "JSON" tab to enter the policy configuration.
10. 5.
    Copy and paste the necessary code provided above into the policy editor.
12. 6.
    Click on "Review policy" to verify the policy configuration.
14. 7.
    Provide a meaningful name and description for the policy.
16. 8.
    Click on "Create policy" to save the policy.
18. 9.
    Go to the S3 service.
20. 10.
    Select each S3 bucket one by one and check their access permissions.
22. 11.
    Remove any public access permissions and ensure that only authorized users or roles have appropriate access.
24. 12.
    Repeat this step for all the S3 buckets in the account.
26. 13.
    Monitor and regularly review the access permissions of the S3 buckets to ensure ongoing compliance.