Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-3-1-1La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Basé sur la classification professionnelle SOC
Affichage de SKILL.md
| name | cis-aws-foundations-3.1.1 |
| description | Ensure S3 Bucket Policy is set to deny HTTP requests |
| category | cis-storage |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","s3","encryption","tls","https","bucket-policy"] |
| cis_id | 3.1.1 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-3.1.2","cis-aws-foundations-3.1.3","cis-aws-foundations-3.1.4"] |
| prerequisites | [] |
| severity_boost | {} |
At the Amazon S3 bucket level, permissions can be configured through a bucket policy to ensure objects are accessible only through HTTPS.
By default, Amazon S3 allows both HTTP and HTTPS requests. To ensure that access to S3 objects is only permitted through HTTPS, you must explicitly deny HTTP requests. Bucket policies that allow HTTPS requests without explicitly denying HTTP requests do not meet this requirement.
If HTTP access is not explicitly denied, data transmitted to and from S3 buckets may be exposed to interception or man-in-the-middle attacks.
Bucket policyOption 1: Deny non-HTTPS requests
{
"Sid": "<optional>",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::<bucket_name>/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
Option 2: Enforce minimum TLS version
{
"Sid": "<optional>",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": ["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/*"],
"Condition": {
"NumericLessThan": {
"s3:TlsVersion": "1.2"
}
}
}
aws s3 ls
aws s3api get-bucket-policy --bucket <bucket_name> | grep aws:SecureTransport
or
aws s3api get-bucket-policy --bucket <bucket_name> | grep s3:TlsVersion
Verify the policy includes either:
"aws:SecureTransport": "false" with "Effect": "Deny""s3:TlsVersion"If no policy is returned, the bucket allows both HTTP and HTTPS requests by default
Each S3 bucket should have a bucket policy that explicitly denies HTTP requests either by using the aws:SecureTransport condition set to false with a Deny effect, or by enforcing a minimum TLS version using the s3:TlsVersion condition.
Permissions tabBucket policyDeny HTTP requests:
{
"Sid": "<optional>",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::<bucket_name>/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
Enforce TLS version:
{
"Sid": "<optional>",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": ["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/*"],
"Condition": {
"NumericLessThan": {
"s3:TlsVersion": "1.2"
}
}
}
Using AWS Policy Generator:
Policy Generator at the bottom of the Bucket Policy editorS3 Bucket Policy as the policy typeEffect = DenyPrincipal = *AWS Service = Amazon S3Actions = *Amazon Resource Name = Generate Policyaws s3api get-bucket-policy --bucket <bucket_name> --query Policy --output text > policy.json
If the bucket does not already have a policy, create a new policy.json file containing a valid bucket policy document.
policy.json to include one of the following deny statements within the Statement array.Option 1: Deny HTTP requests
{
"Sid": "<optional>",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::<bucket_name>/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
Option 2: Enforce minimum TLS version
{
"Sid": "<optional>",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": ["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/*"],
"Condition": {
"NumericLessThan": {
"s3:TlsVersion": "1.2"
}
}
}
aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json
By default, Amazon S3 accepts both HTTP and HTTPS requests. No bucket policy is applied to deny unencrypted (HTTP) access unless explicitly configured.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.10 Encrypt Sensitive Data in Transit | x | x | |
| v7 | 14.4 Encrypt All Sensitive Information in Transit | x | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1040 | TA0006, TA0007 | M1041 |
Level 2 | Automated