lacework-global-54
3.3 Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible (Automated)
Profile Applicability
• Level 1
Description
CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.
Rationale
Allowing public access to CloudTrail log content may aid an adversary in identifying weaknesses in the affected account's use or configuration.
Audit
Perform the following to determine if any public access is granted to an S3 bucket via an ACL or S3 bucket policy:
From Console
- Go to the Amazon CloudTrail console at https://console.aws.amazon.com/cloudtrail/home
- In the
API activity history
pane on the left, clickTrails
- In the
Trails
pane, note the bucket names in theS3 bucket
column - Go to Amazon S3 console at https://console.aws.amazon.com/s3/home
- For each bucket noted in step 3, right-click on the bucket and click
Properties
- In the
Properties
pane, click thePermissions
tab. - The tab shows a list of grants, one row per grant, in the bucket ACL. Each row identifies the grantee and the permissions granted.
- Ensure no rows exists that have the
Grantee
set toEveryone
or theGrantee
set toAny Authenticated User.
- If the
Edit bucket policy
button is present, click it to review the bucket policy. - Ensure the policy does not contain a
Statement
having anEffect
set toAllow
and aPrincipal
set to "*" or {"AWS" : "*"}
From Command Line
- Get the name of the S3 bucket that CloudTrail is logging to:
aws cloudtrail describe-trails --query 'trailList[*].S3BucketName'
- Ensure the
AllUsers
principal is not granted privileges to that<bucket>
:
aws s3api get-bucket-acl --bucket <s3_bucket_for_cloudtrail> --query 'Grants[?Grantee.URI== `https://acs.amazonaws.com/groups/global/AllUsers` ]'
- Ensure the
AuthenticatedUsers
principal is not granted privileges to that<bucket>
:
aws s3api get-bucket-acl --bucket <s3_bucket_for_cloudtrail> --query 'Grants[?Grantee.URI== `https://acs.amazonaws.com/groups/global/Authenticated Users` ]'
- Get the S3 Bucket Policy
aws s3api get-bucket-policy --bucket <s3_bucket_for_cloudtrail>
- Ensure the policy does not contain a
Statement
having anEffect
set toAllow
and aPrincipal
set to "*" or {"AWS" : "*"}
note
Principal set to "*" or {"AWS" : "*"} allows anonymous access.
Remediation
Perform the following to remove any public access that has been granted to the bucket via an ACL or S3 bucket policy:
- Go to Amazon S3 console at https://console.aws.amazon.com/s3/home
- Right-click on the bucket and click Properties
- In the
Properties
pane, click thePermissions
tab. - The tab shows a list of grants, one row per grant, in the bucket ACL. Each row identifies the grantee and the permissions granted.
- Select the row that grants permission to
Everyone
orAny Authenticated User
- Uncheck all the permissions granted to
Everyone
orAny Authenticated User
(clickx
to delete the row). - Click
Save
to save the ACL. - If the
Edit bucket policy
button is present, click it. - Remove any
Statement
having anEffect
set toAllow
and aPrincipal
set to "*" or {"AWS" : "*"}.
References
CCE-78915-6
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html