cis-aws-storage-4-3

name	cis-aws-storage-4.3
description	Ensure the creation of an FSX Bucket
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","fsx","s3","bucket-creation","level-2"]
cis_id	4.3
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-4.1","cis-aws-storage-4.2","cis-aws-storage-4.4","cis-aws-storage-5.1"]
prerequisites	[]
severity_boost	{}

4.3 Ensure the creation of an FSX Bucket (Manual)

Profile Applicability

• Level 2

Description

An S3 bucket will store the data that Amazon Elastic File Cache accesses.

Rationale

Storing data in S3 ensures scalability, durability, and cost-efficiency, while Amazon Elastic File Cache enhances access speed by caching frequently accessed data. This combination leverages the strengths of both services, providing a seamless and efficient data storage and retrieval solution.

Impact

Without creating an S3 bucket for FSx File Cache, there is no persistent storage backend for the cached data. This can lead to data loss, inability to persist data beyond the cache lifecycle, and reduced functionality of the File Cache service.

Audit Procedure

AWS Console

1. Navigate to the Amazon S3 bucket console: https://s3.console.aws.amazon.com/s3/
2. Review existing buckets
3. Verify that a dedicated bucket exists for FSx File Cache usage
4. Confirm the bucket configuration:
   • Bucket must have a unique name globally across AWS
   • Block public access should be enabled (this is an internal service not accessed outside the AWS network)
   • Bucket versioning should be enabled
   • Default encryption should be configured

AWS CLI

# List all S3 buckets
aws s3api list-buckets --query 'Buckets[].[Name,CreationDate]' --output table

# Check bucket configuration for a specific bucket
aws s3api get-bucket-versioning --bucket <bucket-name>
aws s3api get-bucket-encryption --bucket <bucket-name>
aws s3api get-public-access-block --bucket <bucket-name>

Expected Result

An S3 bucket should exist with the following configuration:

• Unique bucket name that is not used anywhere on AWS
• Block public access enabled
• Bucket versioning enabled
• Encryption enabled (default or custom KMS key)
• Appropriate path created within the bucket for FSx cache data

Remediation

AWS Console

1. Navigate to the Amazon S3 bucket console: https://s3.console.aws.amazon.com/s3/
2. Select "Create Bucket"
3. Give your bucket a name and select the region
   • Note: Your bucket must be a unique name that's not used anywhere on AWS