More Info:
The Amazon S3 buckets associated with your CloudTrail trails should have Object Lock feature enabled in order to prevent the objects they store (i.e. trail log files) from being deleted and meet regulatory compliance.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Object Lock Feature Should Be Enabled” misconfiguration in AWS, you can follow the below steps:
- Login to the AWS console.
- Go to the S3 service.
- Select the bucket for which you want to enable Object Lock feature.
- Click on the “Properties” tab.
- Scroll down to the “Object Lock” section.
- Click on the “Edit” button.
- Select the “Enable object lock” radio button.
- Choose the “Retention period” as per your requirement. You can choose either “Governance” or “Compliance” mode.
- Click on the “Save” button.
Using CLI
Using CLI
To remediate the “Object Lock Feature Should Be Enabled” misconfiguration in AWS using AWS CLI, follow these steps:
- Open the AWS CLI on your local machine or EC2 instance.
- Run the following command to enable object lock on a specific S3 bucket:
Make sure to replace
<bucket-name>with the name of the S3 bucket and<number-of-days>with the number of days for which the objects should be locked. - Verify that the object lock feature has been enabled by running the following command:
This should return the object lock configuration for the specified bucket.
Using Python
Using Python
To remediate the “Object Lock Feature Should Be Enabled” misconfiguration in AWS using Python, you can use the following steps:By following these steps, you should be able to remediate the “Object Lock Feature Should Be Enabled” misconfiguration in AWS using Python.
- Import the necessary AWS SDK libraries in your Python code. You can use the
boto3library for this.
- Create an AWS S3 client object using the
boto3.client()method.
- Use the
put_bucket_object_lock_configuration()method of the S3 client object to enable the object lock feature for your S3 bucket. This method takes the following parameters:
Bucket: The name of the S3 bucket for which you want to enable the object lock feature.ObjectLockConfiguration: A dictionary that contains the configuration settings for the object lock feature. In this case, we need to set theObjectLockEnabledkey toEnabled.
- Check the response of the
put_bucket_object_lock_configuration()method to ensure that the object lock feature has been enabled successfully.