🛡️ AWS S3 Bucket auto-provisioning status🟢

• Contextual name: 🛡️ S3 Bucket auto-provisioning status🟢
• ID: /ce/ca/automated-provisioning/aws-s3-bucket
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟠🟢
  • 📗 AWS S3 Bucket
  • 🧪 test-data.json

Description

Open File

Description

Identify AWS S3 Buckets that appear to be associated with AWS CloudFormation or AWS Service Catalog provisioning.

This policy checks for AWS-managed tag signals that can help identify an S3 bucket as associated with AWS CloudFormation or AWS Service Catalog.

Rationale

AWS-managed provisioning tags provide evidence that an S3 bucket is associated with a CloudFormation stack or a Service Catalog provisioned product. This allows to distinguish buckets with supported AWS-managed provisioning indicators from buckets that are not identified by this tag-based method.

Audit

This policy classifies an AWS S3 Bucket as identified by automated provisioning evidence when the bucket has at least one of the following AWS-managed tag keys:

• aws:cloudformation:logical-id
• aws:cloudformation:stack-id
• aws:cloudformation:stack-name
• aws:servicecatalog:portfolioArn
• aws:servicecatalog:productArn
• aws:servicecatalog:provisioningPrincipalArn
• aws:servicecatalog:provisionedProductArn
• aws:servicecatalog:provisioningArtifactIdentifier

... see more

Remediation

Open File

Remediation

Review the S3 bucket and confirm its provisioning source.

Validate whether the bucket is associated with a CloudFormation stack, a Service Catalog provisioned product, another automation workflow, or a manual process. If the provisioning source is known, document the ownership and lifecycle expectations. If the bucket is no longer needed, remove it through the appropriate operational process.

policy.yaml

Open File