AWSOverview
CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy, or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.
Rationale
Allowing public access to CloudTrail log content may aid an adversary in identifying weaknesses in the affected account's use or configuration.
Remediation guidance
Perform the following to remove any public access that has been granted to the bucket via an ACL or S3 bucket policy:
- Go to Amazon S3 console at https://console.aws.amazon.com/s3/home
- Right-click on the bucket and click Properties
- In the
Propertiespane, click thePermissionstab. - The tab shows a list of grants, one row per grant, in the bucket ACL. Each row identifies the grantee and the permissions granted.
- Select the row that grants permission to
EveryoneorAny Authenticated User - Uncheck all the permissions granted to
EveryoneorAny Authenticated User(clickxto delete the row). - Click
Saveto save the ACL. - If the
Edit bucket policybutton is present, click it. - Remove any
Statementhaving anEffectset toAllowand aPrincipalset to "*" or {"AWS" : "*"}.
Default Value
By default, S3 buckets are not publicly accessible
References
- CCE-78915-6
- https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
AWS
Use AWS Organizations guardrails, AWS Config rules or conformance packs where they fit, approved account baselines, and IaC modules so new resources inherit the secure setting.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
The S3 bucket used to store CloudTrail logs is not publicly accessible
Connectors
Covered asset types
Expected check: eq []
{buckets( where: { trails_NOT: null publicAccessBlocked: false OR: [ { hasBucketACLGrant_SOME: { OR: [ { granteeURI: "http://acs.amazonaws.com/groups/global/AllUsers" } { granteeURI: "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" } ] } } { AND: [ { policyDocument_MATCHES: ".+\"Effect\":\"Allow\".+" } { policyDocument_MATCHES: ".+\"Principal\":\"*\".+" } ] } ] } ) {...AssetFragment}}
