Cis AWS Storage 5.2

5.2 Ensure direct data addition to S3 (Manual)

Profile Applicability

• Level 2

Description

Your bucket name must be unique and not already in use on AWS. Click on your bucket name, and in the right corner, you will find an option to upload data directly to your S3 bucket. You can choose the file option to upload individual files, images, or even entire folders.

Rationale

Accessing the upload option within your bucket simplifies the process of adding data, making it easy to manage and organize your files. This streamlined approach allows for efficient data storage, retrieval, and management within the AWS S3 environment, enhancing overall operational efficiency.

Impact

Without direct data upload capability:

• Operational Inefficiency: Manual data transfer processes become more complex
• User Experience: Reduced ease of use for data management
• Data Management: Difficulty organizing and uploading files at scale
• Access Control: May bypass proper access point configurations if not using recommended methods

Audit Procedure

AWS Console

Access Point in S3 Bucket:

Access points are named network endpoints that are attached to buckets which simplify managing data access at scale in S3. To see if any of the access points attached to this bucket grant public or cross-account access, go to IAM Access Analyzer for S3.

1. Navigate to your S3 bucket
2. Click on the bucket name
3. Review the upload functionality:
   • Verify upload button is available in the right corner
   • Check for proper access controls before uploading
4. Review Access Points (if configured):
   • Navigate to the "Access Points" tab
   • Verify access points are properly configured
   • Check IAM Access Analyzer for S3 findings
5. Verify bucket configuration:
   • Unique bucket name (not used anywhere on AWS)
   • Proper VPC configuration (Virtual Private Cloud)
   • Appropriate subnet selection
   • Endpoint policy configuration (if using access points)

AWS CLI

# List objects in bucket to verify upload capability
aws s3 ls s3://<bucket-name>/

# Upload a test file
aws s3 cp <local-file> s3://<bucket-name>/<key-name>

# Verify upload succeeded
aws s3 ls s3://<bucket-name>/<key-name>

# List access points for the bucket
aws s3control list-access-points \
  --account-id <account-id> \
  --bucket <bucket-name>

# Describe specific access point
aws s3control get-access-point \
  --account-id <account-id> \
  --name <access-point-name>

# Check for public access through access points
aws s3control get-access-point-policy-status \
  --account-id <account-id> \
  --name <access-point-name>

Expected Result

S3 bucket should allow direct data upload with:

• Unique bucket name globally across AWS
• Upload functionality available through console or CLI
• Proper access controls configured
• Access points (if used) properly configured with appropriate permissions
• No public or unintended cross-account access through access points
• Files can be uploaded individually or in folders
• Upload process is streamlined and efficient

Remediation

AWS Console

Upload Data to S3 Bucket:

1. Navigate to your S3 bucket
2. Click on your bucket name
3. In the right corner, find the upload option
4. Choose the file option to upload:
   • Individual files
   • Images
   • Entire folders
5. Select files and upload

Configure Access Point (Optional but Recommended for Scale):

1. Enter a name for the access point. The name must be unique within the AWS account and Region
2. Choose the VPC (Virtual Private Cloud) and subnet where you want the access point to be accessible. This determines the network traffic routing for the access point
3. Optionally, you can configure additional settings such as permissions, bucket policy, and endpoint policy for the access point
4. Review the settings, and click on "Create access point" to create the access point

AWS CLI

Upload Files to S3:

# Upload single file
aws s3 cp <local-file> s3://<bucket-name>/<key-name>

# Upload directory (recursive)
aws s3 cp <local-directory>/ s3://<bucket-name>/<prefix>/ --recursive

# Upload with server-side encryption
aws s3 cp <local-file> s3://<bucket-name>/<key-name> \
  --server-side-encryption AES256

# Sync local directory with S3 bucket
aws s3 sync <local-directory>/ s3://<bucket-name>/<prefix>/

Create Access Point:

# Create access point
aws s3control create-access-point \
  --account-id <account-id> \
  --name <access-point-name> \
  --bucket <bucket-name> \
  --vpc-configuration VpcId=<vpc-id>

# Set access point policy
aws s3control put-access-point-policy \
  --account-id <account-id> \
  --name <access-point-name> \
  --policy file://access-point-policy.json

# Verify access point creation
aws s3control get-access-point \
  --account-id <account-id> \
  --name <access-point-name>

Example Access Point Policy (access-point-policy.json):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account-id>:role/<role-name>"
      },
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:<region>:<account-id>:accesspoint/<access-point-name>/object/*"
    }
  ]
}

Default Value

By default:

• S3 buckets support direct upload through console and CLI
• No access points are configured
• Bucket policies and IAM policies control access
• Standard S3 endpoints are used

References

1. https://docs.aws.amazon.com/redshift/latest/dg/tutorial-loading-data-upload-files.html

CIS Controls

Profile

Level 2