> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Config Should Have S3 Bucket Configured

### More Info:

Ensure that Amazon Config service is referencing an active S3 bucket in order to save configuration information (history files and snapshots) for auditing purposes.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of AWS Config not having S3 bucket configured, please follow the below steps:

        1. Login to your AWS console.
        2. Navigate to the AWS Config service.
        3. Click on the "Settings" button in the left navigation pane.
        4. Scroll down to the "Amazon S3 Bucket" section and click on the "Edit" button.
        5. Select the S3 bucket that you want to use for storing AWS Config data.
        6. If you do not have an S3 bucket, create a new one by clicking on the "Create a new S3 bucket" button.
        7. Enter a unique name for the bucket and select the region where you want to create it.
        8. Click on the "Create bucket" button to create the S3 bucket.
        9. After selecting the S3 bucket, click on the "Save" button to save the changes.

        Once you have completed these steps, AWS Config will start storing configuration data in the specified S3 bucket. This will remediate the misconfiguration of AWS Config not having S3 bucket configured.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate this misconfiguration in AWS using AWS CLI, you can follow the below steps:

        1. First, you need to install and configure the AWS CLI on your local machine.

        2. Once the AWS CLI is installed, you need to run the following command to enable AWS Config in your AWS account:

        ```
        aws configservice put-configuration-recorder --configuration-recorder name=default --recording-group allSupported=true --recording-group includeGlobalResourceTypes=true
        ```

        3. After enabling AWS Config, you need to create an S3 bucket to store the AWS Config snapshots. You can use the following command to create an S3 bucket:

        ```
        aws s3api create-bucket --bucket <bucket-name> --region <region-name>
        ```

        Note: Replace `<bucket-name>` and `<region-name>` with your desired values.

        4. Once the S3 bucket is created, you need to configure AWS Config to use this bucket. You can use the following command to configure AWS Config:

        ```
        aws configservice put-delivery-channel --delivery-channel '{"name":"default","s3BucketName":"<bucket-name>","s3KeyPrefix":"AWSConfig","snsTopicARN":""}'
        ```

        Note: Replace `<bucket-name>` with the name of the S3 bucket you created in step 3.

        5. Finally, you need to start the AWS Config recorder by running the following command:

        ```
        aws configservice start-configuration-recorder --configuration-recorder-name default
        ```

        After following these steps, AWS Config will be properly configured to monitor and record changes to your AWS resources.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of AWS Config not having S3 bucket configured, you can follow these steps using Python:

        1. Create an S3 bucket in the desired region where you want to store the AWS Config data. You can use the following Python code to create an S3 bucket:

        ```python theme={null}
        import boto3

        s3 = boto3.client('s3')
        response = s3.create_bucket(Bucket='my-aws-config-bucket', CreateBucketConfiguration={'LocationConstraint': 'us-east-1'})
        ```

        2. Once the S3 bucket is created, you can configure AWS Config to use this S3 bucket as the delivery channel for the configuration data. You can use the following Python code to configure AWS Config:

        ```python theme={null}
        import boto3

        config = boto3.client('config')

        response = config.put_delivery_channel(
            DeliveryChannel={
                'name': 'my-aws-config-delivery-channel',
                's3BucketName': 'my-aws-config-bucket',
                'configSnapshotDeliveryProperties': {
                    'deliveryFrequency': 'Six_Hours'
                }
            }
        )
        ```

        3. Verify that the AWS Config is properly configured by checking the AWS Config dashboard. You should see the S3 bucket as the delivery channel for the configuration data.

        With these steps, you have successfully remediated the misconfiguration of AWS Config not having S3 bucket configured.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # AWS Config delivery channel must reference a valid S3 bucket to store configuration history and snapshots.

        resource "aws_s3_bucket" "config_bucket" {
          bucket = "AWS_CONFIG_BUCKET_NAME" # replace with the actual bucket name to use for AWS Config
        }

        data "aws_iam_policy_document" "config_bucket_policy" {
          statement {
            sid = "AWSConfigBucketPermissionsCheck"
            principals {
              type        = "Service"
              identifiers = ["config.amazonaws.com"]
            }

            actions = [
              "s3:GetBucketAcl",
              "s3:ListBucket",
            ]

            resources = [
              aws_s3_bucket.config_bucket.arn,
            ]
          }

          statement {
            sid = "AWSConfigBucketDelivery"
            principals {
              type        = "Service"
              identifiers = ["config.amazonaws.com"]
            }

            actions = [
              "s3:PutObject",
              "s3:GetBucketLocation",
            ]

            resources = [
              "${aws_s3_bucket.config_bucket.arn}/AWSLogs/${ACCOUNT_ID}/Config/*", # replace ACCOUNT_ID
            ]

            condition {
              test     = "StringEquals"
              variable = "s3:x-amz-acl"

              values = ["bucket-owner-full-control"]
            }
          }
        }

        resource "aws_s3_bucket_policy" "config_bucket_policy" {
          bucket = aws_s3_bucket.config_bucket.id
          policy = data.aws_iam_policy_document.config_bucket_policy.json
        }

        resource "aws_config_delivery_channel" "main" {
          name           = "AWS_CONFIG_DELIVERY_CHANNEL_NAME" # replace with your delivery channel name if needed
          s3_bucket_name = aws_s3_bucket.config_bucket.bucket

          # Preserve any existing settings (SNS topic, snapshot options, etc.) here,
          # mirroring what is currently configured in AWS:
          # s3_key_prefix   = "OPTIONAL_PREFIX"
          # sns_topic_arn   = "arn:aws:sns:REGION:ACCOUNT_ID:TOPIC_NAME"
          # config_snapshot_delivery_properties {
          #   delivery_frequency = "TwentyFour_Hours"
          # }
        }

        # Note: Terraform manages the entire delivery channel object; any settings omitted
        # from aws_config_delivery_channel.main will be removed on apply (similar to the CLI warning).

        ```

        `terraform plan` should show that `aws_config_delivery_channel.main` will have `s3_bucket_name` set to `AWS_CONFIG_BUCKET_NAME` (and create/update the S3 bucket and its policy if they do not already match).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html](https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html)