Skip to main content

🛡️ AWS S3 Bucket sensitive data is not discovered, classified, and secured🟢⚪

  • Contextual name: 🛡️ Bucket sensitive data is not discovered, classified, and secured🟢⚪
  • ID: /ce/ca/aws/s3/bucket-sensitive-data-discovered-classified-and-secured
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Similar Policies​

Description​

Open File

Description​

Amazon S3 buckets can contain sensitive data that, for security purposes, should be discovered, monitored, classified, and protected. Macie, along with other third-party tools, can automatically provide an inventory of Amazon S3 buckets.

Rationale​

Using a cloud service or third-party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.

Impact​

There is a cost associated with using Amazon Macie. There is also typically a cost associated with third-party tools that perform similar processes and protection.

Audit​

Perform the following steps to determine if Macie is running:

From Console​
  1. Log in to the Macie console at https://console.aws.amazon.com/macie/.
  2. In the left-hand pane, click on By job under findings.

... see more

Remediation​

Open File

Remediation​

Perform the steps below to enable and configure Amazon Macie:

From Console​

  1. Log on to the Macie console at https://console.aws.amazon.com/macie/.
  2. Click Get started.
  3. Click Enable Macie.

Setup a repository for sensitive data discovery results:

  1. In the Left pane, under Settings, click Discovery results.
  2. Make sure Create bucket is selected.
  3. Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.
  4. Click on Advanced.
  5. Block all public access, make sure Yes is selected.
  6. KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.
  7. Click on Save.

Create a job to discover sensitive data:

  1. In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.
  2. Select the check box for each bucket that you want Macie to analyze as part of the job.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS AWS v1.4.0 → 💼 2.1.4 Ensure all data in Amazon S3 has been discovered, classified and secured when required1no data
💼 CIS AWS v1.5.0 → 💼 2.1.4 Ensure all data in Amazon S3 has been discovered, classified and secured when required. - Level 2 (Manual)1no data
💼 CIS AWS v2.0.0 → 💼 2.1.3 Ensure all data in Amazon S3 has been discovered, classified and secured when required. - Level 2 (Manual)1no data
💼 CIS AWS v3.0.0 → 💼 2.1.3 Ensure all data in Amazon S3 has been discovered, classified and secured when required - Level 2 (Manual)1no data
💼 CIS AWS v4.0.0 → 💼 2.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary (Manual)1no data
💼 CIS AWS v4.0.1 → 💼 2.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary (Manual)1no data
💼 CIS AWS v5.0.0 → 💼 2.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary (Manual)1no data
💼 CIS AWS v6.0.0 → 💼 3.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary (Manual)1no data
💼 Cloudaware Framework → 💼 Data Protection and Recovery23no data