Skip to content

Commit e9592e5

Browse files
andywick-awsandywick-aws
authored
Merge pull request #67 from aws-samples/solution/s3-block-account-public-access
S3 block account public access solution
2 parents 5d94564 + aab9231 commit e9592e5

16 files changed

+1658
-238
lines changed

‎CHANGELOG.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents <!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2021-11-20](#2021-11-20)
67
- [2021-11-19](#2021-11-19)
78
- [2021-09-02](#2021-09-02)
89
- [2021-09-01](#2021-09-01)
@@ -15,6 +16,16 @@ All notable changes to this project will be documented in this file.
1516

1617
---
1718

19+
## 2021-11-20
20+
21+
### Added <!-- omit in toc -->
22+
23+
- S3 Block Account Public Access solution
24+
25+
### Changed <!-- omit in toc -->
26+
27+
- Nothing Changed
28+
1829
## 2021-11-19
1930

2031
### Added <!-- omit in toc -->

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ The examples within this repository have been deployed and tested using the corr
3939
- [Account Password Policy](aws_sra_examples/solutions/iam/iam_password_policy_acct)
4040
- Macie
4141
- [Organization Macie](aws_sra_examples/solutions/macie/macie_org)
42+
- S3
43+
- [S3 Block Account Public Access](aws_sra_examples/solutions/s3/s3_block_account_public_access)
4244
- SecurityHub
4345
- [Account SecurityHub Enabler](aws_sra_examples/solutions/securityhub/securityhub_enabler_acct)
4446

‎aws_sra_examples/solutions/s3/s3_block_account_public_access/README.md

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# S3 Block Account Public Access <!-- omit in toc -->
2+
3+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
4+
5+
## Table of Contents <!-- omit in toc -->
6+
7+
- [Introduction](#introduction)
8+
- [Deployed Resource Details](#deployed-resource-details)
9+
- [Implementation Instructions](#implementation-instructions)
10+
- [References](#references)
11+
12+
## Introduction
13+
14+
The S3 block account public access solution enables the S3 account level settings within each `AWS account` in the AWS Organization.
15+
16+
The Amazon S3 Block Public Access feature provides settings for access points, buckets, and accounts to help you manage public access to Amazon S3 resources. By default, new buckets, access points, and objects don't allow public access. However,
17+
users can modify bucket policies, access point policies, or object permissions to allow public access. S3 Block Public Access settings override these policies and permissions so that you can limit public access to these resources.
18+
19+
With S3 Block Public Access, account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created.
20+
21+
### Block public access settings <!-- omit in toc -->
22+
23+
> **S3 Block Public Access provides four settings. This solution applies the settings to the account, which applies to all buckets and access points that are owned by that account.**
24+
25+
- **BlockPublicAcls**
26+
- Setting this option to TRUE causes the following behavior:
27+
- PUT Bucket acl and PUT Object acl calls fail if the specified access control list (ACL) is public.
28+
- PUT Object calls fail if the request includes a public ACL.
29+
- If this setting is applied to an account, then PUT Bucket calls fail if the request includes a public ACL.
30+
- **IgnorePublicAcls**
31+
- Setting this option to TRUE causes Amazon S3 to ignore all public ACLs on a bucket and any objects that it contains.
32+
- **BlockPublicPolicy**
33+
- Setting this option to TRUE for a bucket causes Amazon S3 to reject calls to PUT Bucket policy if the specified bucket policy allows public access, and to reject calls to PUT access point policy for all of the bucket's access points if the
34+
specified policy allows public access.
35+
- **RestrictPublicBuckets**
36+
- Setting this option to TRUE restricts access to an access point or bucket with a public policy to only AWS service principals and authorized users within the bucket owner's account. This setting blocks all cross-account access to the access point
37+
or bucket (except by AWS service principals), while still allowing users within the account to manage the access point or bucket.
38+
39+
---
40+
41+
## Deployed Resource Details
42+
43+
![Architecture](./documentation/s3-block-account-public-access.png)
44+
45+
### 1.0 Control Tower Management Account <!-- omit in toc -->
46+
47+
#### 1.1 AWS CloudFormation <!-- omit in toc -->
48+
49+
- All resources are deployed via AWS CloudFormation as a `StackSet` and `Stack Instance` within the management account or a CloudFormation `Stack` within a specific account.
50+
- The [Customizations for AWS Control Tower](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/) solution deploys all templates as a CloudFormation `StackSet`.
51+
- For parameter details, review the [AWS CloudFormation templates](templates/).
52+
53+
#### 1.2 AWS Lambda Function <!-- omit in toc -->
54+
55+
- The AWS Lambda Function contains the logic for configuring the S3 block public access settings within each account.
56+
- The function is triggered by CloudFormation Create, Update, and Delete events and also by the `Control Tower Lifecycle Event Rule` when new accounts are provisioned.
57+
58+
#### 1.3 AWS SSM Parameter Store <!-- omit in toc -->
59+
60+
- The Lambda Function creates/updates configuration parameters within the `SSM Parameter Store` on CloudFormation events and the parameters are used when triggered by the `Control Tower Lifecycle Event Rule`, which does not send the properties on the
61+
event like CloudFormation does.
62+
63+
#### 1.4 AWS Control Tower Lifecycle Event Rule <!-- omit in toc -->
64+
65+
- The AWS Control Tower Lifecycle Event Rule triggers the `AWS Lambda Function` when a new AWS Account is provisioned through AWS Control Tower.
66+
67+
#### 1.5 AWS Lambda CloudWatch Log Group <!-- omit in toc -->
68+
69+
- All the `AWS Lambda Function` logs are sent to a CloudWatch Log Group `</aws/lambda/<LambdaFunctionName>` to help with debugging and traceability of the actions performed.
70+
- By default the `AWS Lambda Function` will create the CloudWatch Log Group with a `Retention` (Never expire) and are encrypted with a CloudWatch Logs service managed encryption key.
71+
- Optional parameters are included to allow creating the CloudWatch Log Group, which allows setting `KMS Encryption` using a customer managed KMS key and setting the `Retention` to a specific value (e.g. 14 days).
72+
73+
#### 1.6 AWS Lambda Function Role <!-- omit in toc -->
74+
75+
- The AWS Lambda Function Role allows the AWS Lambda service to assume the role and perform actions defined in the attached IAM policies.
76+
- The role is also trusted by the S3 Block Account Public Access IAM Role within each account so that it can configure the S3 account settings.
77+
78+
#### 1.7 S3 Block Account Public Access IAM Role <!-- omit in toc -->
79+
80+
- The S3 block account public access IAM role is deployed into each account within the AWS Organization and it is assumed by the central `AWS Lambda Function` to configure the block public access settings for the account.
81+
82+
#### 1.8 S3 Account Settings <!-- omit in toc -->
83+
84+
- The `AWS Lambda Function` configures the block public access settings for the account.
85+
86+
---
87+
88+
### 2.0 All Existing and Future Organization Member Accounts <!-- omit in toc -->
89+
90+
#### 2.1 AWS CloudFormation <!-- omit in toc -->
91+
92+
- See [1.1 AWS CloudFormation](#11-aws-cloudformation)
93+
94+
#### 2.2 S3 Block Account Public Access IAM Role <!-- omit in toc -->
95+
96+
- See [1.7 S3 Block Account Public Access IAM Role](#17-s3-block-account-public-access-iam-role)
97+
98+
#### 2.3 S3 Account Settings <!-- omit in toc -->
99+
100+
- See [1.8 S3 Account Settings](#18-s3-account-settings)
101+
102+
---
103+
104+
## Implementation Instructions
105+
106+
### Prerequisites <!-- omit in toc -->
107+
108+
- AWS Control Tower is deployed.
109+
- No AWS Organizations Service Control Policies (SCPs) are blocking the `s3:GetAccountPublicAccessBlock` and `s3:PutAccountPublicAccessBlock` API actions
110+
- `aws-security-reference-architecture-examples` repository is stored on your local machine or location where you will be deploying from.
111+
112+
### Staging <!-- omit in toc -->
113+
114+
1. In the `management account (home region)`, launch the AWS CloudFormation **Stack** using the [prereq-controltower-execution-role.yaml](../../../utils/aws_control_tower/prerequisites/prereq-controltower-execution-role.yaml) template file as the
115+
source, to implement the `AWSControlTowerExecution` role pre-requisite.
116+
- **Note:** Only do this step, if the `AWSControlTowerExecution` IAM role doesn't already exist in the Control Tower `management account`.
117+
2. In the `management account (home region)`, launch the AWS CloudFormation **StackSet** targeting only the `management account` in all of the enabled regions (include home region)
118+
[prereq-lambda-s3-bucket.yaml](../../../utils/aws_control_tower/prerequisites/prereq-lambda-s3-bucket.yaml) template file as the source, to implement an S3 bucket that will store the Lambda Zip files. (Example Bucket Name:
119+
`lambda-zips-<Management Account ID>-<AWS Region>`)
120+
- For additional guidance see [CloudFormation StackSet Instructions](#cloudformation-stackset-instructions)
121+
- Take note of the S3 Bucket Name from the CloudFormation Outputs, as you will need it for both the packaging step, and the **Solution Deployment Order** section.
122+
- **Note:** Only do this step if you don't already have an S3 bucket to store the Lambda zip files for CloudFormation custom resources in the Control Tower `management account`.
123+
- Lambda functions can only access Zip files from an S3 bucket in the same AWS region as the where Lambda function resides.
124+
- Although for this solution, S3 bucket is only needed in the `home region`, it is recommended to deploy the S3 bucket as a **stackset**, so that you can support future Lambda functions in other regions.
125+
3. Package the Lambda code into a zip file and upload it to the S3 bucket (from above step), using the [Packaging script](../../../utils/packaging_scripts/package-lambda.sh).
126+
- `SRA_REPO` environment variable should point to the folder where `aws-security-reference-architecture-examples` repository is stored.
127+
- `BUCKET` environment variable should point to the S3 Bucket where the Lambda zip files are stored.
128+
- See CloudFormation Output from Step 2
129+
- Or follow this syntax: `lambda-zips-<CONTROL-TOWER-MANAGEMENT-ACCOUNT>-<CONTROL-TOWER-HOME-REGION>`
130+
131+
```bash
132+
# Example (assumes repository was downloaded to your home directory)
133+
export SRA_REPO="$HOME"/aws-security-reference-architecture-examples
134+
export BUCKET=sra-staging-123456789012-us-east-1
135+
sh "$SRA_REPO"/aws_sra_examples/utils/packaging_scripts/package-lambda.sh \
136+
--file_name s3-block-account-public-access.zip \
137+
--bucket $BUCKET \
138+
--src_dir "$SRA_REPO"/aws_sra_examples/solutions/s3/s3_block_account_public_access/lambda/src
139+
```
140+
141+
```bash
142+
# Export AWS CLI profile for the 'management account'
143+
export AWS_ACCESS_KEY_ID=
144+
export AWS_SECRET_ACCESS_KEY=
145+
export AWS_SESSION_TOKEN=
146+
147+
# Use template below and set the 'SRA_REPO' and 'BUCKET' with your values.
148+
export SRA_REPO=
149+
export BUCKET=
150+
sh "$SRA_REPO"/aws_sra_examples/utils/packaging_scripts/package-lambda.sh \
151+
--file_name s3-block-account-public-access.zip \
152+
--bucket $BUCKET \
153+
--src_dir "$SRA_REPO"/aws_sra_examples/solutions/s3/s3_block_account_public_access/lambda/src
154+
```
155+
156+
### Solution Deployment <!-- omit in toc -->
157+
158+
#### Customizations for AWS Control Tower <!-- omit in toc -->
159+
160+
- [Customizations for AWS Control Tower](./customizations_for_aws_control_tower)
161+
162+
#### AWS CloudFormation <!-- omit in toc -->
163+
164+
1. In the `management account (home region)`, launch an AWS CloudFormation **Stack Set** and deploy to `All active accounts (home region)` using the
165+
[sra-s3-block-account-public-access-role.yaml](templates/sra-s3-block-account-public-access-role.yaml) template file as the source.
166+
2. In the `management account (home region)`, launch an AWS CloudFormation **Stack** using the [sra-s3-block-account-public-access-role.yaml](templates/sra-s3-block-account-public-access-role.yaml) template file as the source.
167+
3. In the `management account (home region)`, launch the AWS CloudFormation **Stack** using the [sra-s3-block-account-public-access.yaml](templates/sra-s3-block-account-public-access.yaml) template file as the source.
168+
169+
#### Verify Solution Deployment <!-- omit in toc -->
170+
171+
1. How to verify after the pipeline completes?
172+
1. Log into an account and navigate to the S3 console page
173+
2. Select the `Block Public Access settings for this account` in the side menu and verify the settings match the parameters provided in the configuration
174+
175+
#### Solution Delete Instructions <!-- omit in toc -->
176+
177+
1. In the `management account (home region)`, delete the AWS CloudFormation **Stack** created in step 3 of the solution deployment.
178+
2. In the `management account (home region)`, delete the AWS CloudFormation **Stack** created in step 2 of the solution deployment.
179+
3. In the `management account (home region)`, delete the AWS CloudFormation **StackSet** created in step 1 of the solution deployment. **Note:** there should not be any `stack instances` associated with this StackSet.
180+
4. In the `management account (home region)`, delete the AWS CloudWatch **Log Group** (e.g. /aws/lambda/sra-s3-block-account-public-access) for the Lambda function deployed in step 2 of the solution deployment.
181+
182+
---
183+
184+
## References
185+
186+
- [Blocking public access to your Amazon S3 storage](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)

‎aws_sra_examples/solutions/s3/s3_block_account_public_access/customizations_for_aws_control_tower/README.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Customizations for AWS Control Tower Implementation Instructions <!-- omit in toc -->
2+
3+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
4+
5+
---
6+
7+
## Table of Contents <!-- omit in toc -->
8+
9+
- [Version 1 Solution Deployment](#version-1-solution-deployment)
10+
- [Version 2 Solution Deployment](#version-2-solution-deployment)
11+
- [Solution Delete Instructions](#solution-delete-instructions)
12+
- [How to check the solution version?](#how-to-check-the-solution-version)
13+
- [References](#references)
14+
15+
## Version 1 Solution Deployment
16+
17+
1. Copy the files to the Customizations for AWS Control Tower configuration
18+
19+
- custom-control-tower-configuration
20+
- parameters [**required for manifest version 2020-01-01**]
21+
- Copy the parameter files from the [parameters](./parameters) folder
22+
- policies [optional]
23+
- service control policies files (\*.json)
24+
- templates [**required**]
25+
- Copy the template files from the [templates](../templates) folder
26+
- [manifest.yaml](./manifest.yaml) [**required**]
27+
28+
2. Verify and update the parameters within each of the parameter json files to match the target environment
29+
3. Update the manifest.yaml file with the `organizational unit names`, `account names` and `SSM parameters` for the target environment
30+
4. Deploy the Customizations for AWS Control Tower configuration by pushing the code to the `AWS CodeCommit` repository or uploading to the `AWS S3 Bucket`
31+
32+
## Version 2 Solution Deployment
33+
34+
1. Copy the files to the Customizations for AWS Control Tower configuration
35+
36+
- custom-control-tower-configuration
37+
- policies [optional]
38+
- service control policies files (\*.json)
39+
- templates [**required**]
40+
- Copy the template files from the [templates](../templates) folder
41+
- [manifest.yaml](./manifest-v2.yaml) [**required**]
42+
43+
2. Update the manifest.yaml file with the `parameters`, `organizational unit names`, `account names` and `SSM parameters` for the target environment
44+
3. Deploy the Customizations for AWS Control Tower configuration by pushing the code to the `AWS CodeCommit` repository or uploading to the `AWS S3 Bucket`
45+
46+
## Solution Delete Instructions
47+
48+
1. Within the Customizations for AWS Control Tower configuration
49+
1. Remove the solution configuration from the `manifest.yaml` file
50+
2. (Optional) Delete the parameter (Version 1 only) and template files for the solution
51+
2. Deploy the Customizations for AWS Control Tower configuration
52+
3. After the pipeline completes, log into the `management account` and navigate to the `CloudFormation StackSet` page
53+
1. Delete the Stack Instances from the `CustomControlTower-<solution_name>*` CloudFormation StackSets
54+
2. After the Stack Instances are deleted, delete the `CustomControlTower-<solution_name>*` CloudFormation StackSets
55+
56+
## How to check the solution version?
57+
58+
1. Within the `management account (home region)` find the **CloudFormation Stack** for the Customizations for Control Tower (e.g. custom-control-tower-initiation)
59+
2. Select the `Outputs` tab
60+
3. The `CustomControlTowerSolutionVersion` **Value** is the version running in the environment
61+
1. v1.x.x = manifest.yaml version 2020-01-01
62+
2. v2.x.x = manifest.yaml version 2021-03-15
63+
64+
## References
65+
66+
- [Customizations for AWS Control Tower](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/)

‎aws_sra_examples/solutions/s3/s3_block_account_public_access/customizations_for_aws_control_tower/manifest.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2020-01-01
5+
6+
# Control Tower Custom Service Control Policies
7+
organization_policies: []
8+
9+
# Control Tower Custom CloudFormation Resources
10+
cloudformation_resources:
11+
# -----------------------------------------------------------------------------
12+
# S3 Block Account Public Access Solution
13+
# -----------------------------------------------------------------------------
14+
- name: sra-s3-block-account-public-access-role
15+
template_file: templates/sra-s3-block-account-public-access-role.yaml
16+
parameter_file: parameters/sra-s3-block-account-public-access-role.json
17+
deploy_method: stack_set
18+
deploy_to_ou:
19+
# ALL OUs with active accounts
20+
- Core
21+
- management
22+
- workloads
23+
24+
- name: sra-s3-block-account-public-access
25+
template_file: templates/sra-s3-block-account-public-access.yaml
26+
parameter_file: parameters/sra-s3-block-account-public-access.json
27+
deploy_method: stack_set
28+
deploy_to_account:
29+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME

0 commit comments

Comments
 (0)