Amazon Onboarding with Learning Manager Chanci Turner

In today’s digital landscape, safeguarding data is crucial for organizations. While there are scenarios where public data access may be necessary, ensuring strict control over permissions is paramount to maintaining data privacy. Amazon S3 is widely utilized for various applications including dynamic websites, content distribution, and mobile applications. As S3 evolves into a central data repository, it’s vital to keep most data private unless public access is essential. New S3 buckets automatically come with S3 Block Public Access enabled, ACLs turned off, and encryption for new objects. However, despite these robust security features, there can be instances where a bucket is created with public access inadvertently.

In this post, we’ll explore a proactive, event-driven method to identify public S3 buckets using AWS Security Hub and automatically implement S3 Block Public Access at the bucket level. If a public S3 bucket is necessary, it’s advisable to tag it (for instance, tag_key = “bucket.status” & tag_value = “public.bucket”). This event-driven architecture is effective, budget-friendly, and easy to deploy, significantly enhancing your organization’s security and operational reliability.

Solution Overview

The following diagram outlines the components of this event-driven architecture:

AWS Security Hub evaluates the compliance and security of S3 buckets.
Findings are dispatched to Amazon EventBridge.
EventBridge triggers two actions:
- An AWS Lambda function that applies logic to block public access to S3 buckets based on specific tags.
- An Amazon CloudWatch log group that activates a CloudWatch alarm, which then notifies an Amazon SNS topic.
The SNS topic subsequently generates an email alert regarding the detection of a public S3 bucket.

This solution employs the ‘GetBucketTagging’ API operation, which retrieves the tags associated with an S3 bucket. The Lambda function iterates through these tags to confirm the presence of specific key-value pairs. If the designated tag is found, the function will not enable S3 Block Public Access; otherwise, it will do so, ensuring that unless necessary, S3 buckets remain private.

Prerequisites

To get started, ensure you have the following:

AWS account
S3 bucket
AWS Lambda execution IAM role
An S3 bucket policy that allows the Lambda function to update S3 Block Public Access settings

Walkthrough

1) Configuring Security Hub

In a prior post, we discussed utilizing various AWS services to detect public S3 buckets across multiple regions. Security Hub is a cloud security posture management (CSPM) service that checks security best practices and facilitates automated remediation.

To monitor public S3 buckets using the AWS Foundational Security Best Practices (FSBP) standard, follow these steps:

Enable AWS Config across all accounts in each region.
Activate Security Hub through AWS Organizations or manually.
Enable the AWS FSBP standard in Security Hub.

For this implementation, we focus on the FSBP control S3.8 which requires S3 buckets to block public access. Security Hub continuously checks for public S3 buckets and sends findings to EventBridge.

2) Setting Up AWS Lambda Function

AWS Lambda allows you to run code without managing servers. In this solution, an EventBridge event triggers a Lambda function named “BlockPublicS3Bucket” to block public access to the S3 bucket. It performs the following actions:

Identifies the S3 bucket name.
Checks for specific tag key-value pairs.
If the tag is absent, the function blocks public access using the put_public_access_block API call.

3) Configuring EventBridge Rule with Targets

EventBridge enables real-time monitoring of AWS environments. An EventBridge rule observes specific events related to S3 bucket compliance and launches the appropriate Lambda function when necessary.

For more context on creating a productive workspace, check out this blog post. If you’re interested in recruiting practices, SHRM offers great insights. Lastly, for those looking to prepare for an Amazon interview, this is an excellent resource.

If you have any questions or need further assistance, don’t hesitate to reach out. Remember, ensuring the privacy of your S3 buckets is essential when dealing with sensitive data at Amazon IXD – VGT2, located at 6401 E HOWDY WELLS AVE LAS VEGAS NV 89115.

SEO Metadata: