[IT-2431] Deny insecure access to S3 with an SCP #1312
Conversation
Create a service control policy to deny any S3 api calls that don't use a secure transport layer, such as HTTP, effectively forcing HTTPS. This should address several security findings including IT-2431
| PolicyDocument: | ||
| Version: '2012-10-17' | ||
| Statement: | ||
| - Sid: DenyInsecureS3 | ||
| Effect: Deny | ||
| Action: | ||
| - 's3:*' | ||
| Resource: '*' | ||
| Condition: | ||
| Bool: | ||
| 'aws:SecureTransport': false |
There was a problem hiding this comment.
The following AWS KB seems to indicate that we would need "Principal": "*" in this PolicyDocument?
https://repost.aws/knowledge-center/s3-bucket-policy-for-config-rule
You should test to see what type of message you get when attempting to get files over http
There was a problem hiding this comment.
Thanks, I saw that KB article but it's describing a bucket policy and this PR is creating a service control policy, so I don't think the Principal is needed, I don't see it in any of the examples here
I'm working on setting up a test in the sandbox organization, I'll comment my results in the ticket.
There was a problem hiding this comment.
ohh, hmm. i'm not sure 'aws:SecureTransport': false is supported for SCP but i guess the easiest thing to do is try a deploy and see what happens.
There was a problem hiding this comment.
Oh, hrm. I tried this out in the test org, and it created the SCP just fine but it had no effect. We'll have to go through each bucket individually and either add the policy or suppress the finding.
| PolicyDocument: | ||
| Version: '2012-10-17' | ||
| Statement: | ||
| - Sid: DenyInsecureS3 | ||
| Effect: Deny | ||
| Action: | ||
| - 's3:*' | ||
| Resource: '*' | ||
| Condition: | ||
| Bool: | ||
| 'aws:SecureTransport': false |
There was a problem hiding this comment.
ohh, hmm. i'm not sure 'aws:SecureTransport': false is supported for SCP but i guess the easiest thing to do is try a deploy and see what happens.
|
This SCP had no effect in the test org, closing this and reopening #1310 |
3 participants
Create a service control policy to deny any S3 api calls that don't use a secure transport layer, such as HTTP, effectively forcing HTTPS.
This should address several security findings including IT-2431