detection.wiki

Detection rules › Panther

AWS S3 Bucket Principal Restrictions

Severity
high
Compliance
PCI 10.5.1, 10.5.2
Tags
AWS, Identity & Access Management, Collection:Data From Cloud Storage Object
Reference
https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
Source
github.com/panther-labs/panther-analysis

This policy validates that S3 Bucket access policies do not allow all users (Principal:"*") for a given action on the bucket, in accordance with the principle of least privilege.

MITRE ATT&CK coverage

TacticTechniques
CollectionT1530 Data from Cloud Storage

Rule body yaml

AnalysisType: policy
Filename: aws_s3_bucket_principal_restrictions.py
PolicyID: "AWS.S3.Bucket.PrincipalRestrictions"
DisplayName: "AWS S3 Bucket Principal Restrictions"
Enabled: true
ResourceTypes:
  - AWS.S3.Bucket
Tags:
  - AWS
  - Identity & Access Management
  - Collection:Data From Cloud Storage Object
Reports:
  PCI:
    - 10.5.1
    - 10.5.2
  MITRE ATT&CK:
    - TA0009:T1530
Severity: High
Description: >
  This policy validates that S3 Bucket access policies do not allow all users (Principal:"*") for a given action on the bucket, in accordance with the principle of least privilege.
Runbook: >
  https://docs.runpanther.io/alert-runbooks/built-in-policies/aws-s3-bucket-policy-restricts-principal
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
Tests:
  - Name: Bucket Does Not Restrict Principal
    ExpectedResult: false
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }
  - Name: Bucket Does Restrict Principal
    ExpectedResult: true
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }
  - Name: Bucket Does Not Restrict Principal But Has Condition
    ExpectedResult: true
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2008-10-17","Statement":[{"Sid":"Access","Effect":"Allow","Principal":"*","Action":["s3:GetObject","s3:GetObjectAcl","s3:ListBucket"],"Resource":["arn:aws:s3:::example-bucket"],"Condition":{"StringEquals":{"aws:PrincipalOrgID":"111111"}}}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }

Detection logic

Condition

Policy not is_null

This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Policyis_null(no value, null check)