S3 Buckets with Website Hosting Configuration Enabled

01 Sign in to the AWS Management Console.

02 Navigate to Amazon S3 console at https://console.aws.amazon.com/s3/.

03 Click on the name of the S3 bucket that you want to examine to access the bucket configuration settings.

04 Select the Properties tab from the console menu to access the bucket properties.

05 In the Static website hosting section, check the Static website hosting configuration attribute value. If the attribute value is set to Enabled, the selected Amazon S3 bucket is configured for website hosting. If the Static website hosting attribute value is set to Disabled, the Audit process ends here.

06 Sign into your TrendAI Vision One™ account to access Cloud Risk Management, access the S3 Buckets with Website Configuration Enabled rule settings and compare the name of the S3 bucket verified at the previous step against each bucket name listed within the rule configuration. If the selected bucket is not listed in the rule configuration section, the Amazon S3 bucket should be reviewed in order to decide whether or not to disable the website hosting feature.

07 Repeat steps no. 3 – 6 for each Amazon S3 bucket created within your AWS cloud account.

01 Run list-buckets command (OSX/Linux/UNIX) using custom query filters to list the names of all Amazon S3 buckets available in your AWS cloud account:

aws s3api list-buckets
	--query 'Buckets[*].Name'

02 The command output should return an array with the requested bucket names:

[
  "trendmicro",
  "trendmicro-media",
  "trendmicro-logs"
]

03 Run get-bucket-website command (OSX/Linux/UNIX) using the name of the Amazon S3 bucket that you want to examine as the identifier parameter to describe the website configuration associated with the selected S3 bucket:

aws s3api get-bucket-website
	--bucket trendmicro

04 The command output should return the requested configuration information:

1. If get-bucket-website command output returns the NoSuchWebsiteConfiguration error message, as shown in the output example below, the selected Amazon S3 bucket is not configured for website hosting, therefore the Audit process ends here:
   An error occurred (NoSuchWebsiteConfiguration) when calling the GetBucketWebsite operation: The specified bucket does not have a website configuration
   

2. If get-bucket-website command output returns the name of the Index document, as shown in the output example below, the selected Amazon S3 bucket is currently configured for website hosting:
   {
     "IndexDocument": {
       "Suffix": "index.html"
     }
   }
   

05 Sign into your TrendAI Vision One™ account to access Cloud Risk Management, access the S3 Buckets with Website Configuration Enabled rule settings and compare the name of the S3 bucket verified at the previous step against each bucket name listed within the rule configuration. If the selected bucket is not listed in the rule configuration section, the Amazon S3 bucket should be reviewed in order to decide whether or not to disable the website hosting feature.

06 Repeat steps no. 3 – 5 for each Amazon S3 bucket available in your AWS cloud account.

01 CloudFormation template (JSON):

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "(Re)Create S3 Bucket Without Website Configuration",
  "Resources": {
    "S3Bucket": {
      "Properties": {
        "BucketName": "trendmicro",
        "AccessControl": "Private",
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "IgnorePublicAcls": true,
          "BlockPublicPolicy": true,
          "RestrictPublicBuckets": true
        },
        "VersioningConfiguration": {
          "Status": "Enabled"
        }
      },
      "Type": "AWS::S3::Bucket"
    }
  }
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
Description: "(Re)Create S3 Bucket Without Website Configuration"
Resources:
  S3Bucket:
    Properties:
      BucketName: trendmicro
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
    Type: AWS::S3::Bucket

01 Terraform configuration file (.tf):

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = "~> 3.27"
    }
  }

  required_version = ">= 0.14.9"
}

provider "aws" {
  profile = "default"
  region = "us-east-1"
}

resource "aws_s3_bucket" "s3-data-bucket" {
  bucket = "trendmicro"
  acl = "private"
  versioning {
    enabled = true
  }
}

resource "aws_s3_bucket_public_access_block" "private-s3-bucket" {
  bucket = "trendmicro"
  block_public_acls = true
  ignore_public_acls = true
  block_public_policy = true
  restrict_public_buckets = true
}

01 Sign in to the AWS Management Console.

02 Navigate to Amazon S3 console at https://console.aws.amazon.com/s3/.

03 Click on the name of the S3 bucket that you want to reconfigure (see Audit section part I to identify the right S3 resource).

04 Select the Properties tab from the console menu to access the bucket properties.

05 In the Static website hosting section, choose Edit to modify the feature configuration.

06 On the Edit static website hosting configuration page, select Disable under Static website hosting to disable the feature for the selected Amazon S3 bucket. Choose Save changes to apply the changes. Once the website hosting is disabled, the content of the selected Amazon S3 bucket is no longer accessible from the website endpoint.

07 Repeat steps no. 3 – 6 to disable website hosting for other Amazon S3 buckets created within your AWS cloud account.

01 Run delete-bucket-website command (OSX/Linux/UNIX) using the name of the Amazon S3 bucket that you want to reconfigure as the identifier parameter (see Audit section part II to identify the right S3 resource), to remove the website configuration from the selected S3 bucket (if successful, the command should not return an output):

aws s3api delete-bucket-website
  --bucket trendmicro

02 Repeat step no. 1 to disable website hosting for other Amazon S3 buckets available in your AWS cloud account.