S3 Buckets Should Not Allow Public Writes

More Info:

AWS S3 buckets should not be publicly accessible for WRITE actions via S3 access control lists (ACLs), in order to protect your S3 data from unauthorized users.

Risk Level

Critical

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• HIPAA
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration in AWS:

1. Log in to the AWS Management Console.
2. Navigate to the S3 service.
3. Click on the name of the bucket that you want to remediate.
4. Click on the “Permissions” tab.
5. Under the “Block public access (bucket settings)” section, click on “Edit”.
6. Uncheck the box next to “Block all public access”.
7. Check the box next to “Block public access to buckets and objects granted through new public bucket policies”.
8. Check the box next to “Block public and cross-account access to buckets and objects through any public bucket policies”.
9. Click on “Save changes”.

After following these steps, your S3 bucket will no longer allow public writes.

Using CLI

The following steps can be taken to remediate the S3 bucket public write issue in AWS using AWS CLI:

1. Open the AWS CLI on your local machine.

2. Run the following command to list all the S3 buckets in your AWS account:

aws s3 ls

3. Identify the S3 bucket that has public write access.

4. Run the following command to remove public write access from the S3 bucket:

aws s3api put-bucket-acl --bucket BUCKET-NAME --acl private

Replace BUCKET-NAME with the name of the S3 bucket that has public write access.

5. Run the following command to verify that the public write access has been removed from the S3 bucket:

aws s3api get-bucket-acl --bucket BUCKET-NAME

Replace BUCKET-NAME with the name of the S3 bucket that has public write access.

6. If the above command returns the following output, then public write access has been successfully removed from the S3 bucket:

{
    "Grants": [
        {
            "Grantee": {
                "Type": "CanonicalUser",
                "ID": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
            },
            "Permission": "FULL_CONTROL"
        }
    ],
    "Owner": {
        "DisplayName": "owner-name",
        "ID": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    }
}

Note: It is important to regularly audit the S3 buckets in your AWS account to ensure that they are not publicly accessible and have the appropriate access controls in place.

Using Python

To remediate the misconfiguration “S3 Buckets Should Not Allow Public Writes” in AWS, you can use the following steps in Python:

1. Install the AWS SDK for Python (Boto3) using the command pip install boto3.

2. Create an S3 client using the following code:

import boto3

s3 = boto3.client('s3')

3. Get a list of all S3 buckets in your AWS account using the list_buckets() method:

response = s3.list_buckets()

for bucket in response['Buckets']:
    bucket_name = bucket['Name']

4. For each bucket, check if it allows public write access using the get_bucket_acl() method:

acl = s3.get_bucket_acl(Bucket=bucket_name)

for grant in acl['Grants']:
    grantee = grant['Grantee']
    permission = grant['Permission']
    
    if 'URI' in grantee and grantee['URI'] == 'http://acs.amazonaws.com/groups/global/AllUsers' and permission == 'WRITE':
        # Bucket allows public write access

5. If the bucket allows public write access, remove the permission using the put_bucket_acl() method:

s3.put_bucket_acl(
    Bucket=bucket_name,
    ACL='private'
)

The final code to remediate the misconfiguration “S3 Buckets Should Not Allow Public Writes” in AWS using Python will look something like this:

import boto3

s3 = boto3.client('s3')

response = s3.list_buckets()

for bucket in response['Buckets']:
    bucket_name = bucket['Name']
    
    acl = s3.get_bucket_acl(Bucket=bucket_name)

    for grant in acl['Grants']:
        grantee = grant['Grantee']
        permission = grant['Permission']

        if 'URI' in grantee and grantee['URI'] == 'http://acs.amazonaws.com/groups/global/AllUsers' and permission == 'WRITE':
            s3.put_bucket_acl(
                Bucket=bucket_name,
                ACL='private'
            )

Using Terraform

resource "aws_s3_bucket" "THIS_BUCKET" {
  bucket = "YOUR_BUCKET_NAME" # replace with your bucket name
}

resource "aws_s3_bucket_public_access_block" "THIS_BUCKET_block_public_access" {
  bucket = aws_s3_bucket.THIS_BUCKET.id

  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

This matches the s3:PutBucketPublicAccessBlock CLI fix and will block all current and future public access (including reads) for YOUR_BUCKET_NAME.
It does not force replacement of the bucket; Terraform will create or update only the aws_s3_bucket_public_access_block resource.

Verification: terraform plan should show an aws_s3_bucket_public_access_block resource being created or updated with all four arguments set to true and no aws_s3_bucket.THIS_BUCKET replacement.

Additional Reading:

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html