Rule: S3 Buckets Should Prohibit Public Write Access

Rule Description:

Troubleshooting Steps:

2. 1.
   Ensure that the AWS Identity and Access Management (IAM) policies associated with your S3 buckets are properly configured.
4. 2.
   Verify that there are no conflicting bucket policies or access control lists (ACLs) that allow public write access.
6. 3.
   Review the S3 bucket configuration to check for any misconfigurations or unintended settings that enable public write access.
8. 4.
   Double-check the permissions of any IAM users, roles, or groups that have access to the S3 buckets to ensure there are no unintended write permissions granted.

Necessary Codes:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPublicWriteAccess",
            "Effect": "Deny",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl"
            ],
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalArn": "arn:aws:iam::*:root"
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPublicWriteAccess",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl"
            ],
            "Resource": "arn:aws:s3:::bucket-name/*"
        }
    ]
}

Step-by-Step Guide for Remediation:

2. 1.
   Open the AWS Management Console and navigate to the S3 service.
4. 2.
   Select the desired bucket that needs remediation.
6. 3.
   Click on the "Permissions" tab for the selected bucket.
8. 4.
   Check if you have an existing bucket policy:

   • If there is no existing bucket policy, proceed to step 6.
   • If there is an existing bucket policy, proceed to the next step.
10. 5.
    Add the following statement within the existing bucket policy, under the "Statement" array:

    {
        "Sid": "DenyPublicWriteAccess",
        "Effect": "Deny",
        "Principal": "*",
        "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:PutObjectVersionAcl"
        ],
        "Resource": "arn:aws:s3:::bucket-name/*"
    }
    

    Replace "bucket-name" with the name of your S3 bucket.
12. 6.
    If there is no existing bucket policy, create a new one with the following policy document:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "DenyPublicWriteAccess",
                "Effect": "Deny",
                "Principal": "*",
                "Action": [
                    "s3:PutObject",
                    "s3:PutObjectAcl",
                    "s3:PutObjectVersionAcl"
                ],
                "Resource": "arn:aws:s3:::bucket-name/*"
            }
        ]
    }
    

    Replace "bucket-name" with the name of your S3 bucket.
14. 7.
    Click on the "Access control list (ACL)" tab for the selected bucket.
16. 8.
    Verify that there are no grants that allow public write access. If any exist, remove them.
18. 9.
    Click on the "Bucket Policy" tab for the selected bucket.
20. 10.
    Verify that there are no conflicting bucket policies or settings that allow public write access. If any exist, modify or remove them.
22. 11.
    Save the changes made to the bucket policy, ACL, and permissions settings.
24. 12.
    Repeat these steps for any other S3 buckets that require remediation.