cis-aws-storage-5-2

name	cis-aws-storage-5.2
description	Ensure direct data addition to S3
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","s3","data-upload","access-point","level-2"]
cis_id	5.2
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-5.1","cis-aws-storage-5.3"]
prerequisites	["cis-aws-storage-5.1"]
severity_boost	{}

5.2 Ensure direct data addition to S3 (Manual)

Profile Applicability

• Level 2

Description

Your bucket name must be unique and not already in use on AWS. Click on your bucket name, and in the right corner, you will find an option to upload data directly to your S3 bucket. You can choose the file option to upload individual files, images, or even entire folders.

Rationale

Accessing the upload option within your bucket simplifies the process of adding data, making it easy to manage and organize your files. This streamlined approach allows for efficient data storage, retrieval, and management within the AWS S3 environment, enhancing overall operational efficiency.

Impact

Without direct data upload capability:

• Operational Inefficiency: Manual data transfer processes become more complex
• User Experience: Reduced ease of use for data management
• Data Management: Difficulty organizing and uploading files at scale
• Access Control: May bypass proper access point configurations if not using recommended methods

Audit Procedure

AWS Console

Access Point in S3 Bucket:

Access points are named network endpoints that are attached to buckets which simplify managing data access at scale in S3. To see if any of the access points attached to this bucket grant public or cross-account access, go to IAM Access Analyzer for S3.

1. Navigate to your S3 bucket
2. Click on the bucket name
3. Review the upload functionality:
   • Verify upload button is available in the right corner
   • Check for proper access controls before uploading
4. Review Access Points (if configured):
   • Navigate to the "Access Points" tab
   • Verify access points are properly configured
   • Check IAM Access Analyzer for S3 findings
5. Verify bucket configuration:
   • Unique bucket name (not used anywhere on AWS)
   • Proper VPC configuration (Virtual Private Cloud)
   • Appropriate subnet selection
   • Endpoint policy configuration (if using access points)

AWS CLI

# List objects in bucket to verify upload capability
aws s3 ls s3://<bucket-name>/

# Upload a test file
aws s3 cp <local-file> s3://<bucket-name>/<key-name>


aws s3  s3://<bucket-name>/<key-name>


aws s3control list-access-points \
  --account-id <account-id> \
  --bucket <bucket-name>


aws s3control get-access-point \
  --account-id <account-id> \
  --name <access-point-name>


aws s3control get-access-point-policy-status \
  --account-id <account-id> \
  --name <access-point-name>