Update cfngoat.yaml

[mikeurbanski1]

No description provided.

[bridgecrew]

Bridgecrew has found infrastructure configuration errors in this PR ⬇️

[bridgecrew]

Suggested change

	DataBucket2:
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	PublicAccessBlockConfiguration:
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"

  Ensure S3 bucket RestrictPublicBucket is set to True
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_22

Description

The S3 Block Public Access configuration enables specifying whether S3 should restrict public bucket policies for buckets in this account. Setting RestrictPublicBucket to TRUE restricts access to buckets with public policies to only AWS services and authorized users within this account.

Enabling this setting does not affect previously stored bucket policies. Public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.

[bridgecrew]

Suggested change

	DataBucket2:
	DataBucket2:
	# Public, not encrypted, no access logs, no versioning
	Type: AWS::S3::Bucket
	DeletionPolicy: Delete
	Properties:
	BucketName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	AccessControl: Private
	Tags:
	- Key: Name
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"

  Ensure bucket ACL does not grant READ permission to everyone
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_1

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **READ** access to everyone can provide attackers the ability to read object data within the bucket, which can lead to the exposure of sensitive data. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for READ actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

• NIST-800-53 AC-17

🪄 Smart Fix -

Fix based on 60% past actions

[bridgecrew]

  Ensure AWS access logging is enabled on S3 buckets
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_13

Description

Access logging provides detailed audit logging for all objects and folders in an S3 bucket.

Benchmarks

• HIPAA 164.312(B) Audit controls

[bridgecrew]

Suggested change

	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	VersioningConfiguration:
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"

  Ensure AWS S3 object versioning is enabled
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_16

Description

S3 versioning is a managed data backup and recovery service provided by AWS. When enabled it allows users to retrieve and restore previous versions of their buckets.

S3 versioning can be used for data protection and retention scenarios such as recovering objects that have been accidentally/intentionally deleted or overwritten.

Benchmarks

• PCI-DSS V3.2.1 10.5.3
• FEDRAMP (MODERATE) CP-10, SI-12

[bridgecrew]

Suggested change

	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	BucketEncryption:
	ServerSideEncryptionConfiguration:
	- ServerSideEncryptionByDefault:
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"

  Ensure data stored in the S3 bucket is securely encrypted at rest
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_14

Description

SSE helps prevent unauthorized access to S3 buckets. Encrypting and decrypting data at the S3 bucket level is transparent to users when accessing data.

Benchmarks

• PCI-DSS V3.2 3
• NIST-800-53 AC-17, SC-2
• PCI-DSS V3.2.1 3.4
• FEDRAMP (MODERATE) SC-28
• CIS AWS V1.3 2.1.1

[bridgecrew]

Suggested change

	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	PublicAccessBlockConfiguration:
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"

  Ensure S3 bucket has block public ACLS enabled
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_19

Description

Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.

This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.

We recommend you set S3 Bucket BlockPublicAcls to True.

Benchmarks

• CIS AWS V1.3 1.20

[bridgecrew]

Suggested change

	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"
	PublicAccessBlockConfiguration:
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data2"

  Ensure S3 bucket IgnorePublicAcls is set to True
    Resource: AWS::S3::Bucket.DataBucket2 | ID: BC_AWS_S3_21

Description

The IgnorePublicAcls setting causes S3 to ignore all public ACLs on a bucket and any objects that it contains. Enabling this setting does not affect the persistence of any existing ACLs and does not prevent new public ACLs from being set.

This setting will block public access granted by ACLs while still allowing PUT Object calls that include a public ACL.