Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-storage-5-3La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basé sur la classification professionnelle SOC
Affichage de SKILL.md
| name | cis-aws-storage-5.3 |
| description | Ensure Storage Classes are Configured |
| category | cis-storage-services |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","s3","storage-classes","cost-optimization","lifecycle","intelligent-tiering","glacier","level-2"] |
| cis_id | 5.3 |
| cis_benchmark | CIS AWS Storage Services Benchmark v1.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-storage-5.1","cis-aws-storage-5.2"] |
| prerequisites | ["cis-aws-storage-5.1"] |
| severity_boost | {} |
Amazon S3 offers various storage classes to optimize cost and performance based on data access patterns and retention needs. Standard Storage is for frequently accessed data, while Standard-IA and One Zone-IA are for infrequent access, with the latter offering cost savings by storing in a single Availability Zone. Intelligent-Tiering automatically moves data between access tiers based on usage, and Glacier and Glacier Deep Archive provide low-cost options for long-term archival storage with varying retrieval times. Each class balances availability, durability, performance, and cost, enabling a tailored storage strategy to meet specific requirements.
This approach ensures frequently accessed data is readily available, while infrequently accessed data is stored cost-effectively, balancing availability, durability, and cost.
Not configuring appropriate storage classes can result in:
# List objects with their storage classes
aws s3api list-objects-v2 \
--bucket <bucket-name> \
--query 'Contents[].[Key,StorageClass,Size,LastModified]' \
--output table
aws s3api head-object \
--bucket <bucket-name> \
--key <object-key> \
--query
aws s3api get-bucket-lifecycle-configuration \
--bucket <bucket-name>
aws s3api list-bucket-intelligent-tiering-configurations \
--bucket <bucket-name>
aws s3api list-objects-v2 \
--bucket <bucket-name> \
--query | | -c
S3 storage classes should be properly configured based on data access patterns:
Available Storage Classes:
S3 Standard:
S3 Standard-IA (Infrequent Access):
S3 One Zone-IA:
S3 Intelligent-Tiering:
S3 Glacier Flexible Retrieval (formerly S3 Glacier):
S3 Glacier Deep Archive:
Configure Storage Class for New Upload:
Change Storage Class for Existing Object:
Configure Lifecycle Policy:
Upload Object with Specific Storage Class:
# Upload to Standard-IA
aws s3 cp <local-file> s3://<bucket-name>/<key> \
--storage-class STANDARD_IA
# Upload to Intelligent-Tiering
aws s3 cp <local-file> s3://<bucket-name>/<key> \
--storage-class INTELLIGENT_TIERING
# Upload to Glacier Flexible Retrieval
aws s3 cp <local-file> s3://<bucket-name>/<key> \
--storage-class GLACIER
# Upload to Glacier Deep Archive
aws s3 cp <local-file> s3://<bucket-name>/<key> \
--storage-class DEEP_ARCHIVE
Change Storage Class of Existing Object:
aws s3api copy-object \
--bucket <bucket-name> \
--copy-source <bucket-name>/<key> \
--key <key> \
--storage-class INTELLIGENT_TIERING \
--metadata-directive COPY
Configure Lifecycle Policy:
aws s3api put-bucket-lifecycle-configuration \
--bucket <bucket-name> \
--lifecycle-configuration file://lifecycle.json
Example lifecycle.json:
{
"Rules": [
{
"Id": "Archive-old-data",
"Status": "Enabled",
"Filter": {
"Prefix": ""
},
"Transitions": [
{
"Days": 30,
"StorageClass": "STANDARD_IA"
},
{
"Days": 90,
"StorageClass": "GLACIER"
},
{
"Days": 365,
"StorageClass": "DEEP_ARCHIVE"
}
],
"Expiration": {
"Days": 2555
}
}
]
}
Enable Intelligent-Tiering:
aws s3api put-bucket-intelligent-tiering-configuration \
--bucket <bucket-name> \
--id <config-id> \
--intelligent-tiering-configuration file://intelligent-tiering.json
Example intelligent-tiering.json:
{
"Id": "EntireBucket",
"Status": "Enabled",
"Tierings": [
{
"Days": 90,
"AccessTier": "ARCHIVE_ACCESS"
},
{
"Days": 180,
"AccessTier": "DEEP_ARCHIVE_ACCESS"
}
]
}
By default:
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | ● | ● | ● |
| v8 | 8.3 Ensure Adequate Audit Log Storage Ensure that logging destinations maintain adequate storage to comply with the enterprise's audit log management process. | ● | ● | ● |
| v7 | 7.8 Implement DMARC and Enable Receiver-Side Verification To lower the chance of spoofed or modified emails from valid domains, implement Domain-based Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail(DKIM) standards. | ● | ● |
Level 2