cis-aws-foundations-3-1-3

name	cis-aws-foundations-3.1.3
description	Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary
category	cis-storage
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","storage","s3","macie","data-classification","data-discovery"]
cis_id	3.1.3
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-3.1.1","cis-aws-foundations-3.1.2","cis-aws-foundations-3.1.4"]
prerequisites	[]
severity_boost	{}

Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary

Description

Amazon S3 buckets can contain sensitive data that, for security purposes, should be discovered, monitored, classified, and protected. Macie, along with other third-party tools, can automatically provide an inventory of Amazon S3 buckets.

Rationale

Using a cloud service or third-party software to continuously monitor and automate the process of data discovery and classification for S3 buckets through machine learning and pattern matching is a strong defense in protecting that information.

Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.

Impact

There is a cost associated with using Amazon Macie, and there is typically a cost associated with third-party tools that perform similar processes and provide protection.

Audit Procedure

Using AWS Console

1. Login to the Macie console at https://console.aws.amazon.com/macie/.
2. In the left hand pane, click on By job under findings.
3. Confirm that you have a job set up for your S3 buckets.

When you log into the Macie console, if you are not taken to the summary page and do not have a job set up and running, then refer to the remediation procedure below.

If you are using a third-party tool to manage and protect your S3 data, you meet this recommendation.

Using AWS CLI

No specific CLI audit procedure is provided for this control. Use the console to verify Macie configuration.

Expected Result

Amazon Macie should be enabled and configured with discovery jobs for S3 buckets, or a third-party equivalent tool should be in use for data discovery and classification.

Remediation

Using AWS Console

Enable Amazon Macie:

1. Log on to the Macie console at https://console.aws.amazon.com/macie/.
2. Click Get started.
3. Click Enable Macie.

Set up a repository for sensitive data discovery results:

1. In the left pane, under Settings, click Discovery results.
2. Make sure Create bucket is selected.
3. Create a bucket and enter a name for it. The name must be unique across all S3 buckets, and it must start with a lowercase letter or a number.
4. Click .