How to Find AWS S3 Buckets Missing Public Access Blocks
Public access policies may be applied to sensitive data buckets.
info
This security check is part of the CIS Amazon Web Services Benchmarks and is rated severity high.
Prerequisites
This guide assumes that you have already installed and configured Fix Inventory to collect your AWS resources.
Directions
-
Execute the following
search
command in Fix Inventory Shell:> search is(aws_s3_bucket) {account_setting: <-[0:]- is(aws_account) --> is(aws_s3_account_settings)} (bucket_public_access_block_configuration.block_public_acls==false and account_setting.reported.bucket_public_access_block_configuration.block_public_acls==false) or (bucket_public_access_block_configuration.ignore_public_acls==false and account_setting.reported.bucket_public_access_block_configuration.ignore_public_acls==false) or (bucket_public_access_block_configuration.block_public_policy==false and account_setting.reported.bucket_public_access_block_configuration.block_public_policy==false) or (bucket_public_access_block_configuration.restrict_public_buckets==false and account_setting.reported.bucket_public_access_block_configuration.restrict_public_buckets==false)
kind=aws_s3_bucket, ..., region=fixinventory-poweruser
kind=aws_s3_bucket, ..., account=poweruser-team -
Pipe the
search
command into thedump
command:> search is(aws_s3_bucket) {account_setting: <-[0:]- is(aws_account) --> is(aws_s3_account_settings)} (bucket_public_access_block_configuration.block_public_acls==false and account_setting.reported.bucket_public_access_block_configuration.block_public_acls==false) or (bucket_public_access_block_configuration.ignore_public_acls==false and account_setting.reported.bucket_public_access_block_configuration.ignore_public_acls==false) or (bucket_public_access_block_configuration.block_public_policy==false and account_setting.reported.bucket_public_access_block_configuration.block_public_policy==false) or (bucket_public_access_block_configuration.restrict_public_buckets==false and account_setting.reported.bucket_public_access_block_configuration.restrict_public_buckets==false) | dump
reported:
id: /aws/s3/123
name: some-name
ctime: '2022-12-05T22:53:14Z'
kind: aws_s3_bucket
age: 2mo28dThe command output will list the details of all non-compliant
aws_s3_bucket
resources.
Remediation
Enable Public Access Block at the account level to prevent the exposure of your data stored in S3.
note
Please refer to the AWS S3 documentation for details.