Guided Walkthroughs
Step-by-step configuration wizards for your environment
Dedicated Security Account
AWS Backup Strategy
VPC Connectivity Setup
Automated Patching
All Guides
CloudFormation guard rules template for Amazon S3 resources
The following rules are included:
let s3_buckets = Resources.*[
Type == "AWS::S3::Bucket"
]
rule s3_access_logging when %s3_buckets !empty {
%s3_buckets {
Properties {
LoggingConfiguration exists <<Logging is not configured.>>
}
}
}
rule s3_bucket_versioning when %s3_buckets !empty {
%s3_buckets {
Properties {
VersioningConfiguration exists <<Bucket versioning is not configured (i.e. disabled).>>
when VersioningConfiguration exists {
VersioningConfiguration {
Status exists <<Bucket versioning status is not configured (i.e. disabled).>>
when Status exists {
Status == "Enabled" <<Bucket versioning is not enabled.>>
}
}
}
}
}
}
rule s3_bucket_object_lock_enabled when %s3_buckets !empty {
%s3_buckets {
Properties {
ObjectLockEnabled exists <<ObjectLockEnabled is not set (i.e. disabled).>>
when ObjectLockEnabled exists {
ObjectLockEnabled == true <<Object Lock is disabled.>>
}
}
}
}
rule s3_bucket_encryption when %s3_buckets !empty {
%s3_buckets {
Properties {
BucketEncryption exists <<BucketEncryption is not configured. (i.e. disabled)>>
when BucketEncryption exists {
BucketEncryption {
some ServerSideEncryptionConfiguration.* {
ServerSideEncryptionByDefault exists <<ServerSideEncryptionByDefault is not configured. (i.e. disabled)>>
}
}
}
}
}
}
rule s3_bucket_kms_encryption when %s3_buckets !empty {
%s3_buckets {
Properties {
BucketEncryption exists <<BucketEncryption is not configured. (i.e. disabled)>>
when BucketEncryption exists {
BucketEncryption {
some ServerSideEncryptionConfiguration.* {
ServerSideEncryptionByDefault exists <<ServerSideEncryptionByDefault is not configured. (i.e. disabled)>>
when ServerSideEncryptionByDefault exists {
ServerSideEncryptionByDefault {
SSEAlgorithm == "aws:kms" <<KMS encryptionm not used.>>
}
}
}
}
}
}
}
}
rule s3_bucket_key_enabled when %s3_buckets !empty {
%s3_buckets {
Properties {
when BucketEncryption exists {
BucketEncryption {
some ServerSideEncryptionConfiguration.* {
when ServerSideEncryptionByDefault exists {
when ServerSideEncryptionByDefault.SSEAlgorithm == "aws:kms" {
BucketKeyEnabled == true <<Bucket Key is disabled.>>
}
}
}
}
}
}
}
}