Skip to content

[IT-2431] Deny insecure access to S3 with an SCP #1312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ConsoleCatzirl wants to merge 1 commit into from
Closed

[IT-2431] Deny insecure access to S3 with an SCP #1312

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions org-formation/_scp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,3 +175,20 @@
Action:
- organizations:LeaveOrganization
Resource: "*"

RequireSecureS3:
Type: OC::ORG::ServiceControlPolicy
Properties:
PolicyName: RequireSecureS3
Description: Restrict users from accessing S3 over HTTP
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: DenyInsecureS3
Effect: Deny
Action:
- 's3:*'
Resource: '*'
Condition:
Bool:
'aws:SecureTransport': false
Comment on lines +184 to +194
Copy link
Contributor

@zaro0508 zaro0508 Jan 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The following AWS KB seems to indicate that we would need "Principal": "*" in this PolicyDocument?
https://repost.aws/knowledge-center/s3-bucket-policy-for-config-rule

You should test to see what type of message you get when attempting to get files over http

Copy link
Member Author

@ConsoleCatzirl ConsoleCatzirl Jan 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I saw that KB article but it's describing a bucket policy and this PR is creating a service control policy, so I don't think the Principal is needed, I don't see it in any of the examples here

I'm working on setting up a test in the sandbox organization, I'll comment my results in the ticket.

Copy link
Contributor

@zaro0508 zaro0508 Jan 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ohh, hmm. i'm not sure 'aws:SecureTransport': false is supported for SCP but i guess the easiest thing to do is try a deploy and see what happens.

Copy link
Member Author

@ConsoleCatzirl ConsoleCatzirl Jan 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, hrm. I tried this out in the test org, and it created the SCP just fine but it had no effect. We'll have to go through each bucket individually and either add the policy or suppress the finding.

Loading