S3 Buckets Should Have Lifecycle Configuration Enabled

More Info:

Your Amazon S3 buckets should have lifecycle configuration enabled for security and cost optimization purposes.

Risk Level

Medium

Address

Operational Maturity, Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step by step instructions to remediate this issue in AWS:

1. Log in to your AWS Management Console.
2. Navigate to the S3 Dashboard.
3. Select the S3 bucket that you want to remediate.
4. Click on the “Management” tab.
5. Click on “Lifecycle” in the left-hand menu.
6. Click on the “Add lifecycle rule” button.
7. In the “Name and scope” section, give a name to the rule and select the prefix or tag that you want to apply the rule to.
8. In the “Transitions” section, select the transition actions that you want to apply to the objects in the bucket. For example, you can choose to move objects to Glacier storage class after a certain number of days.
9. In the “Expiration” section, set the expiration action for the objects in the bucket. For example, you can choose to delete objects after a certain number of days.
10. Click on “Review” to review your configuration.
11. Click on “Create and activate rule” to create the lifecycle rule and activate it for the selected bucket.

Once you complete these steps, the lifecycle configuration will be enabled for the S3 bucket, which will help you to manage the lifecycle of the objects in the bucket automatically.

Using CLI

To remediate the misconfiguration of S3 buckets not having lifecycle configuration enabled in AWS using AWS CLI, follow these steps:

1. Open a terminal window and install the AWS CLI if it is not already installed.
2. Authenticate the AWS CLI with your AWS account by running the following command:
   aws configure
   
   This will prompt you to enter your AWS Access Key ID, AWS Secret Access Key, default region name, and default output format.
3. Once authenticated, run the following command to enable lifecycle configuration for all S3 buckets in your AWS account:
   aws s3api put-bucket-lifecycle-configuration --bucket <bucket-name> --lifecycle-configuration file://lifecycle.json
   
   Replace <bucket-name> with the name of the S3 bucket that you want to enable lifecycle configuration for.
4. Create a JSON file named lifecycle.json and add the following content to it:
   {
     "Rules": [
       {
         "Status": "Enabled",
         "Prefix": "",
         "Expiration": {
           "Days": 365
         }
       }
     ]
   }
   
   This configuration will delete any objects in the bucket that are older than 365 days.
5. Repeat step 3 for each S3 bucket in your AWS account that does not have lifecycle configuration enabled.

By following these steps, you will enable lifecycle configuration for all S3 buckets in your AWS account, which will help you to automatically manage the lifecycle of your objects in the bucket.

Using Python

To remediate this misconfiguration in AWS, you can use the following Python code to enable lifecycle configuration for all S3 buckets in your AWS account:

1. First, you need to import the necessary libraries:

import boto3
from botocore.exceptions import ClientError

2. Then, you need to create an S3 client:

s3 = boto3.client('s3')

3. Next, you need to get a list of all S3 buckets in your account:

buckets = []
response = s3.list_buckets()
for bucket in response['Buckets']:
    buckets.append(bucket['Name'])

4. For each bucket, you need to check if lifecycle configuration is already enabled:

for bucket in buckets:
    try:
        response = s3.get_bucket_lifecycle_configuration(Bucket=bucket)
        # If there is no exception, lifecycle configuration is already enabled
        print(f"Lifecycle configuration is already enabled for {bucket}")
    except ClientError as e:
        if e.response['Error']['Code'] == 'NoSuchLifecycleConfiguration':
            # If the exception is NoSuchLifecycleConfiguration, lifecycle configuration is not enabled
            print(f"Enabling lifecycle configuration for {bucket}")
            # Enable lifecycle configuration for the bucket
            s3.put_bucket_lifecycle_configuration(
                Bucket=bucket,
                LifecycleConfiguration={
                    'Rules': [
                        {
                            'Expiration': {
                                'Days': 30
                            },
                            'ID': 'Delete old objects',
                            'Status': 'Enabled',
                            'NoncurrentVersionExpiration': {
                                'NoncurrentDays': 7
                            }
                        }
                    ]
                }
            )
        else:
            # If the exception is something else, print the error message
            print(f"Error: {e}")

5. In the above code, we are enabling lifecycle configuration with a rule that deletes objects older than 30 days and noncurrent versions older than 7 days. You can modify this rule as per your requirements.

6. Finally, you can run this Python script to enable lifecycle configuration for all S3 buckets in your AWS account.

Using Terraform

resource "aws_s3_bucket" "BUCKET" {
  bucket = "BUCKET_NAME" # replace with your S3 bucket name
}

resource "aws_s3_bucket_lifecycle_configuration" "BUCKET_LIFECYCLE" {
  bucket = aws_s3_bucket.BUCKET.id

  rule {
    id     = "AbortIncompleteMultipartUploads"
    status = "Enabled"

    filter {
      prefix = ""
    }

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
}

This configuration applies the same sample lifecycle rule as the CLI fix, aborting incomplete multipart uploads after 7 days. It overwrites any existing lifecycle configuration on the bucket; review current rules before applying to avoid unintended data loss. The change is in-place and does not force bucket replacement.

To verify, terraform plan should show creation (or update) of aws_s3_bucket_lifecycle_configuration.BUCKET_LIFECYCLE with one enabled rule named AbortIncompleteMultipartUploads and no other lifecycle rules on that bucket managed by Terraform.

Additional Reading:

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-set-lifecycle-configuration-intro.html