AnalysisType: policy
Filename: aws_s3_bucket_secure_access.py
PolicyID: "AWS.S3.Bucket.SecureAccess"
DisplayName: "AWS S3 Bucket Secure Access"
Enabled: true
ResourceTypes:
- AWS.S3.Bucket
Tags:
- AWS
- Security Control
- Collection:Data From Cloud Storage Object
Reports:
PCI:
- 2.2.3
- 4.1
MITRE ATT&CK:
- TA0009:T1530
Severity: Low
Description: >
Ensures access to S3 buckets is forced to use a secure (HTTPS) connection.
Runbook: >
https://docs.runpanther.io/alert-runbooks/built-in-policies/aws-s3-bucket-policy-enforces-secure-access
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
Tests:
- Name: Bucket Uses Implicit Allow
ExpectedResult: false
Resource:
{
"CreationDate": "2019-01-01T00:00:00Z",
"EncryptionRules":
[
{
"ApplyServerSideEncryptionByDefault":
{ "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
},
],
"Grants": null,
"LifecycleRules": null,
"Location": "us-east-2",
"LoggingPolicy": null,
"MFADelete": null,
"Name": "bucket-name",
"Owner":
{
"DisplayName": "user.name",
"ID": "11112223334445556667778899aaabbbcccdddeeee",
},
"Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"], "Condition":{"Bool":{"aws:SecureTransport": "true"}}},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Condition":{"Bool":{"aws:SecureTransport": "true"}},"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
"PublicAccessBlockConfiguration":
{
"BlockPublicAcls": false,
"BlockPublicPolicy": false,
"IgnorePublicAcls": false,
"RestrictPublicBuckets": false,
},
"Versioning": null,
}
- Name: Bucket Uses Allow With Wrong Condition
ExpectedResult: false
Resource:
{
"CreationDate": "2019-01-01T00:00:00Z",
"EncryptionRules":
[
{
"ApplyServerSideEncryptionByDefault":
{ "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
},
],
"Grants": null,
"LifecycleRules": null,
"Location": "us-east-2",
"LoggingPolicy": null,
"MFADelete": null,
"Name": "bucket-name",
"Owner":
{
"DisplayName": "user.name",
"ID": "11112223334445556667778899aaabbbcccdddeeee",
},
"Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"], "Condition":{"Bool":{"aws:SecureTransport": "false"}}},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
"PublicAccessBlockConfiguration":
{
"BlockPublicAcls": false,
"BlockPublicPolicy": false,
"IgnorePublicAcls": false,
"RestrictPublicBuckets": false,
},
"Versioning": null,
}
- Name: Bucket Uses Allow Without Condition
ExpectedResult: false
Resource:
{
"CreationDate": "2019-01-01T00:00:00Z",
"EncryptionRules":
[
{
"ApplyServerSideEncryptionByDefault":
{ "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
},
],
"Grants": null,
"LifecycleRules": null,
"Location": "us-east-2",
"LoggingPolicy": null,
"MFADelete": null,
"Name": "bucket-name",
"Owner":
{
"DisplayName": "user.name",
"ID": "11112223334445556667778899aaabbbcccdddeeee",
},
"Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
"PublicAccessBlockConfiguration":
{
"BlockPublicAcls": false,
"BlockPublicPolicy": false,
"IgnorePublicAcls": false,
"RestrictPublicBuckets": false,
},
"Versioning": null,
}
- Name: Bucket Has No Access Policy
ExpectedResult: false
Resource:
{
"CreationDate": "2019-01-01T00:00:00Z",
"EncryptionRules":
[
{
"ApplyServerSideEncryptionByDefault":
{ "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
},
],
"Grants": null,
"LifecycleRules": null,
"Location": "us-east-2",
"LoggingPolicy": null,
"MFADelete": null,
"Name": "bucket-name",
"Owner":
{
"DisplayName": "user.name",
"ID": "11112223334445556667778899aaabbbcccdddeeee",
},
"Policy": null,
"PublicAccessBlockConfiguration":
{
"BlockPublicAcls": false,
"BlockPublicPolicy": false,
"IgnorePublicAcls": false,
"RestrictPublicBuckets": false,
},
"Versioning": null,
}
- Name: Bucket Uses Explicit Deny
ExpectedResult: true
Resource:
{
"CreationDate": "2019-01-01T00:00:00Z",
"EncryptionRules":
[
{
"ApplyServerSideEncryptionByDefault":
{ "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
},
],
"Grants": null,
"LifecycleRules": null,
"Location": "us-east-2",
"LoggingPolicy": null,
"MFADelete": null,
"Name": "test-bucket",
"Owner":
{
"DisplayName": "user.name",
"ID": "11112223334445556667778899aaabbbcccdddeeee",
},
"Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal": "*","Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"], "Condition":{"Bool":{"aws:SecureTransport": "false"}}},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Condition":{"Bool":{"aws:SecureTransport": "true"}},"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
"PublicAccessBlockConfiguration":
{
"BlockPublicAcls": false,
"BlockPublicPolicy": false,
"IgnorePublicAcls": false,
"RestrictPublicBuckets": false,
},
"Versioning": null,
}
# ------ paired body: aws_s3_bucket_secure_access.py ------
import json
from panther_base_helpers import deep_get
from policyuniverse.policy import Policy
# According to AWS there should exist an explicit deny policy that contains
# "aws:SecureTransport": "false" for this check to be compliant
# https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/
# This policy returns a LOW severity alert if the bucket policy is using an implicit deny
# of secure transport or a HIGH severity if secure transport is not enforced.
IMPLICIT_DENY = True
def policy(resource):
if resource["Policy"] is None:
return False
explicit_deny = False
global IMPLICIT_DENY # pylint: disable=global-statement
# Reset global to prevent it getting stepped on by reuse in the Lambda invocation
IMPLICIT_DENY = True
iam_policy = Policy(json.loads(resource["Policy"]))
for statement in iam_policy.statements:
if (
statement.effect == "Deny"
and deep_get(statement.statement, "Condition", "Bool", "aws:SecureTransport") != "true"
):
explicit_deny = True
break
if (
statement.effect == "Allow"
and deep_get(statement.statement, "Condition", "Bool", "aws:SecureTransport") != "true"
):
IMPLICIT_DENY = False
return explicit_deny
def severity(_):
if IMPLICIT_DENY:
return "LOW"
return "HIGH"
def title(resource):
if IMPLICIT_DENY:
return f"{resource.get('Name')} lacks an explicit deny policy for Secure Transport"
return f"{resource.get('Name')} does not enforce Secure Transport"