cis-aws-storage-5-3

name	cis-aws-storage-5.3
description	Ensure Storage Classes are Configured
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","s3","storage-classes","cost-optimization","lifecycle","intelligent-tiering","glacier","level-2"]
cis_id	5.3
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-5.1","cis-aws-storage-5.2"]
prerequisites	["cis-aws-storage-5.1"]
severity_boost	{}

5.3 Ensure Storage Classes are Configured (Manual)

Profile Applicability

• Level 2

Description

Amazon S3 offers various storage classes to optimize cost and performance based on data access patterns and retention needs. Standard Storage is for frequently accessed data, while Standard-IA and One Zone-IA are for infrequent access, with the latter offering cost savings by storing in a single Availability Zone. Intelligent-Tiering automatically moves data between access tiers based on usage, and Glacier and Glacier Deep Archive provide low-cost options for long-term archival storage with varying retrieval times. Each class balances availability, durability, performance, and cost, enabling a tailored storage strategy to meet specific requirements.

Rationale

This approach ensures frequently accessed data is readily available, while infrequently accessed data is stored cost-effectively, balancing availability, durability, and cost.

Impact

Not configuring appropriate storage classes can result in:

• Cost Inefficiency: Paying for Standard storage pricing for infrequently accessed data
• Wasted Resources: Not leveraging cost-optimized storage tiers
• Missed Savings: Failing to use Intelligent-Tiering for data with unknown or changing access patterns
• Suboptimal Performance: Using archive storage classes for frequently accessed data
• Compliance Issues: Not meeting data retention requirements with appropriate archival storage

Audit Procedure

AWS Console

1. Navigate to the Amazon S3 console
2. Select a bucket
3. Review objects and their storage classes:
   • Click on individual objects
   • Check the "Properties" tab
   • Verify the storage class assignment
4. Review lifecycle policies:
   • Navigate to "Management" tab
   • Check "Lifecycle rules"
   • Verify automatic transitions between storage classes
5. Check for Intelligent-Tiering configuration:
   • Review objects using S3 Intelligent-Tiering
   • Verify automatic tier optimization is enabled

AWS CLI

# List objects with their storage classes
aws s3api list-objects-v2 \
  --bucket <bucket-name> \
  --query 'Contents[].[Key,StorageClass,Size,LastModified]' \
  --output table


aws s3api head-object \
  --bucket <bucket-name> \
  --key <object-key> \
  --query 


aws s3api get-bucket-lifecycle-configuration \
  --bucket <bucket-name>


aws s3api list-bucket-intelligent-tiering-configurations \
  --bucket <bucket-name>


aws s3api list-objects-v2 \
  --bucket <bucket-name> \
  --query  |  |  -c