Skip to main content

Pro audit program · v1.0

AWS S3 Bucket Hardening

Quick check of public-access, encryption, logging and lifecycle on your S3 estate. Built around the CIS AWS benchmark for S3.

  • General target area
  • CIS AWS framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Quick check of public-access, encryption, logging and lifecycle on your S3 estate. Built around the CIS AWS benchmark for S3.

Risks addressed

  • Critical Publicly readable bucket exposes sensitive data
  • High Unencrypted data at rest
  • High Accidental object deletion with no versioning
  • High Excessive cross-account access

Controls (7)

  1. Block Public Access enabled account-wide

    Critical

    Block Public Access enabled account-wide

    How to test + evidence

    Testing procedure: Run aws s3control get-public-access-block — all 4 settings true.

    Evidence to collect: CLI output.

  2. Default encryption set on all buckets

    High

    Default encryption set on all buckets

    How to test + evidence

    Testing procedure: Run s3api get-bucket-encryption per bucket; SSE-S3 or SSE-KMS expected.

    Evidence to collect: CLI output / Config rule.

  3. Versioning enabled for buckets holding important data

    Medium

    Versioning enabled for buckets holding important data

    How to test + evidence

    Testing procedure: For Tier-1 buckets, verify Versioning=Enabled.

    Evidence to collect: CLI output.

  4. Server access logging enabled

    Medium

    Server access logging enabled

    How to test + evidence

    Testing procedure: Confirm access logs are written to a centralised logging bucket.

    Evidence to collect: CLI output + log destination.

  5. MFA Delete enabled for critical buckets

    High

    MFA Delete enabled for critical buckets

    How to test + evidence

    Testing procedure: Verify MFA Delete on production data buckets.

    Evidence to collect: CLI output.

  6. Lifecycle policies in place

    Low

    Lifecycle policies in place

    How to test + evidence

    Testing procedure: Buckets have lifecycle rules to expire / transition old objects.

    Evidence to collect: CLI output of get-bucket-lifecycle.

  7. Cross-account access reviewed

    High

    Cross-account access reviewed

    How to test + evidence

    Testing procedure: Review bucket policies for wildcards / cross-account principals. Confirm justification.

    Evidence to collect: Bucket policies export.