Remediation

From Console

1. Log in to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/

2. Select the checkbox next to the bucket.

3. Click Permissions.

4. Click Bucket Policy.

5. Add either of the following to the existing policy, filling in the required information:

   {
       "Sid": "{{optional}}",
       "Effect": "Deny",
       "Principal": "*",
       "Action": "s3:*",
       "Resource": "arn:aws:s3:::{{bucket_name}}/*",
       "Condition": {
           "Bool": {
               "aws:SecureTransport": "false"
           }
       }
   }

   or

   {
       "Sid": "{{optional}}",
       "Effect": "Deny",
       "Principal": "*",
       "Action": "s3:*",
       "Resource": [
           "arn:aws:s3:::{{bucket_name}}",
           "arn:aws:s3:::{{bucket_name}}/*"
       ],
       "Condition": {
           "NumericLessThan": {
               "s3:TlsVersion": "1.2"
           }
       }
   }

6. Click Save.

7. Repeat for all the buckets in your AWS account that contain sensitive data.

From Console using AWS Policy Generator

1. Repeat steps 1-4 above.
2. Click on Policy Generator at the bottom of the Bucket Policy Editor.
3. Select Policy Type S3 Bucket Policy.
4. Add statements.
   • Effect = Deny
   • Principal = *
   • AWS Service = Amazon S3
   • Actions = *
   • Amazon Resource Name = {{ARN of the S3 Bucket}}
5. Generate Policy.
6. Copy the text and add it to the Bucket Policy.

From Command Line

1. Export the bucket policy to a JSON file.

   aws s3api get-bucket-policy --bucket {{bucket_name}} --query Policy --output text > policy.json

2. Modify the policy.json file by adding either of the following:

   {
       "Sid": "{{optional}}",
       "Effect": "Deny",
       "Principal": "*",
       "Action": "s3:*",
       "Resource": "arn:aws:s3:::{{bucket_name}}/*",
       "Condition": {
           "Bool": {
               "aws:SecureTransport": "false"
           }
       }
   }

   or

   {
       "Sid": "{{optional}}",
       "Effect": "Deny",
       "Principal": "*",
       "Action": "s3:*",
       "Resource": [
           "arn:aws:s3:::{{bucket_name}}",
           "arn:aws:s3:::{{bucket_name}}/*"
       ],
       "Condition": {
           "NumericLessThan": {
               "s3:TlsVersion": "1.2"
           }
       }
   }

3. Apply this modified policy back to the S3 bucket:

   aws s3api put-bucket-policy --bucket {{bucket_name}} --policy file://policy.json