القائمة
Ensure that your Lightsail buckets are not publicly accessible
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-5-9يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | cis-aws-compute-5.9 |
| description | Ensure that your Lightsail buckets are not publicly accessible |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lightsail","buckets","public-access","permissions","storage"] |
| cis_id | 5.9 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-5.7","cis-aws-compute-5.8","cis-aws-compute-5.10"] |
| prerequisites | [] |
| severity_boost | {} |
You can make all objects private, public (read-only) or private while making individual objects public (read-only). By default when creating a bucket the permissions are set to "All objects are private".
When the Bucket access permissions are set to All objects are public (read-only) - All objects in the bucket are readable by anyone on the internet through the URL of the bucket.
N/A
All services, click Lightsail under Compute.Storage.All objects are private
All objects are public (read-Only)
Individual objects can be public
All objects are public (read-Only) and or 'Individual objects can be public' refer to the remediation below.aws lightsail get-bucketsaws lightsail get-buckets
This command will provide a list of Buckets tied to Lightsail.
"accessRules": {
"getObject": "private",
"allowPublicOverrides": false
}
All Lightsail buckets should have access rules set to "getObject": "private" and , meaning all objects are private.
"allowPublicOverrides": falseAll services, click Lightsail under Compute.Storage.All objects are public (read-Only) listed.PermissionsChange permissionsAll objects are privateSaveAll objects are public (read-Only) and/or Individual objects can be made public and read onlyaws lightsail update-bucketaws lightsail update-bucket --bucket-name <name from list in audit> --access-rules getObject="private",allowPublicOverrides=false
By default when creating a bucket the permissions are set to "All objects are private".
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists - Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | x | x | x |
| v7 | 14.6 Protect Information through Access Control Lists - Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. | x | x | x |
Level 1 | Manual