Branch2

[KumeshUTS]

update instance size

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

Suggested change

	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
	PublicAccessBlockConfiguration:
	BlockPublicAcls: True

  AWS S3 Buckets has block public access setting disabled
    Resource: AWS::S3::Bucket.DataBucket | ID: BC_AWS_S3_19

Description

Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.

This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.

We recommend you set S3 Bucket BlockPublicAcls to True.

Benchmarks

• CIS AWS V1.3 1.20

[prisma-cloud-devsecops]

Suggested change

AccessControl: PublicRead

  AWS S3 bucket ACL grants READ permission to everyone
    Resource: AWS::S3::Bucket.DataBucket | ID: BC_AWS_S3_1

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **READ** access to everyone can provide attackers the ability to read object data within the bucket, which can lead to the exposure of sensitive data. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for READ actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

• NIST-800-53 AC-17

[prisma-cloud-devsecops]

  EC2 user data exposes secrets
    Resource: AWS::EC2::Instance.EC2Instance | ID: BC_AWS_SECRETS_1

Description

**User Data** is a metadata field of an EC2 instance that allows custom code to run after the instance is launched. It contains code exposed to any entity which has the most basic access to EC2, even read-only configurations. This code is not encrypted.

Removing secrets from easily-accessed unencrypted places reduces the risk of passwords, private keys and more from being exposed to third parties.

[prisma-cloud-devsecops]

  EC2 user data exposes secrets
    Resource: AWS::EC2::Instance.EC2Instance | ID: BC_AWS_SECRETS_1

Description

**User Data** is a metadata field of an EC2 instance that allows custom code to run after the instance is launched. It contains code exposed to any entity which has the most basic access to EC2, even read-only configurations. This code is not encrypted.

Removing secrets from easily-accessed unencrypted places reduces the risk of passwords, private keys and more from being exposed to third parties.

[prisma-cloud-devsecops]

Suggested change

	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
	PublicAccessBlockConfiguration:
	BlockPublicPolicy: True

  AWS S3 Bucket BlockPublicPolicy is not set to True
    Resource: AWS::S3::Bucket.DataBucket | ID: BC_AWS_S3_20

Description

Amazon S3 Block Public Access policy works at the account level and on individual buckets, including those created in the future. It provides the ability to block existing public access, whether specified by an ACL or a policy, and ensures public access is not granted to newly created items.

If an AWS account is used to host a data lake or another business application, blocking public access will serve as an account-level guard against accidental public exposure.

Benchmarks

• PCI-DSS V3.2.1 1.3, 2.2
• FEDRAMP (MODERATE) AC-3, AC-4, AC-6, AC-21(b), SC-7, SC-7(3)

[prisma-cloud-devsecops]

Suggested change

	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
	BucketEncryption:
	ServerSideEncryptionConfiguration:
	- ServerSideEncryptionByDefault:
	SSEAlgorithm: AES256

  AWS S3 buckets do not have server side encryption
    Resource: AWS::S3::Bucket.DataBucket | ID: 807152290778968064_AWS_1665713844027

[prisma-cloud-devsecops]

  AWS Access logging not enabled on S3 buckets
    Resource: AWS::S3::Bucket.DataBucket | ID: BC_AWS_S3_13

Description

Access logging provides detailed audit logging for all objects and folders in an S3 bucket.

Benchmarks

• HIPAA 164.312(B) Audit controls

[prisma-cloud-devsecops]

Suggested change

	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
	Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
	PublicAccessBlockConfiguration:
	IgnorePublicAcls: True

  AWS S3 bucket IgnorePublicAcls is not set to True
    Resource: AWS::S3::Bucket.DataBucket | ID: BC_AWS_S3_21

Description

The IgnorePublicAcls setting causes S3 to ignore all public ACLs on a bucket and any objects that it contains. Enabling this setting does not affect the persistence of any existing ACLs and does not prevent new public ACLs from being set.

This setting will block public access granted by ACLs while still allowing PUT Object calls that include a public ACL.