AWS Config Should Have S3 Bucket Configured

Using Console

To remediate the misconfiguration of AWS Config not having S3 bucket configured, please follow the below steps:

Login to your AWS console.
Navigate to the AWS Config service.
Click on the “Settings” button in the left navigation pane.
Scroll down to the “Amazon S3 Bucket” section and click on the “Edit” button.
Select the S3 bucket that you want to use for storing AWS Config data.
If you do not have an S3 bucket, create a new one by clicking on the “Create a new S3 bucket” button.
Enter a unique name for the bucket and select the region where you want to create it.
Click on the “Create bucket” button to create the S3 bucket.
After selecting the S3 bucket, click on the “Save” button to save the changes.

Once you have completed these steps, AWS Config will start storing configuration data in the specified S3 bucket. This will remediate the misconfiguration of AWS Config not having S3 bucket configured.

Using CLI

To remediate this misconfiguration in AWS using AWS CLI, you can follow the below steps:

First, you need to install and configure the AWS CLI on your local machine.
Once the AWS CLI is installed, you need to run the following command to enable AWS Config in your AWS account:

aws configservice put-configuration-recorder --configuration-recorder name=default --recording-group allSupported=true --recording-group includeGlobalResourceTypes=true

After enabling AWS Config, you need to create an S3 bucket to store the AWS Config snapshots. You can use the following command to create an S3 bucket:

aws s3api create-bucket --bucket <bucket-name> --region <region-name>

Note: Replace <bucket-name> and <region-name> with your desired values.

Once the S3 bucket is created, you need to configure AWS Config to use this bucket. You can use the following command to configure AWS Config:

aws configservice put-delivery-channel --delivery-channel '{"name":"default","s3BucketName":"<bucket-name>","s3KeyPrefix":"AWSConfig","snsTopicARN":""}'

Note: Replace <bucket-name> with the name of the S3 bucket you created in step 3.

Finally, you need to start the AWS Config recorder by running the following command:

aws configservice start-configuration-recorder --configuration-recorder-name default

After following these steps, AWS Config will be properly configured to monitor and record changes to your AWS resources.

Using Python

To remediate the misconfiguration of AWS Config not having S3 bucket configured, you can follow these steps using Python:

Create an S3 bucket in the desired region where you want to store the AWS Config data. You can use the following Python code to create an S3 bucket:

import boto3

s3 = boto3.client('s3')
response = s3.create_bucket(Bucket='my-aws-config-bucket', CreateBucketConfiguration={'LocationConstraint': 'us-east-1'})

Once the S3 bucket is created, you can configure AWS Config to use this S3 bucket as the delivery channel for the configuration data. You can use the following Python code to configure AWS Config:

import boto3

config = boto3.client('config')

response = config.put_delivery_channel(
    DeliveryChannel={
        'name': 'my-aws-config-delivery-channel',
        's3BucketName': 'my-aws-config-bucket',
        'configSnapshotDeliveryProperties': {
            'deliveryFrequency': 'Six_Hours'
        }
    }
)

Verify that the AWS Config is properly configured by checking the AWS Config dashboard. You should see the S3 bucket as the delivery channel for the configuration data.

With these steps, you have successfully remediated the misconfiguration of AWS Config not having S3 bucket configured.

Using Terraform

# AWS Config delivery channel must reference a valid S3 bucket to store configuration history and snapshots.

resource "aws_s3_bucket" "config_bucket" {
  bucket = "AWS_CONFIG_BUCKET_NAME" # replace with the actual bucket name to use for AWS Config
}

data "aws_iam_policy_document" "config_bucket_policy" {
  statement {
    sid = "AWSConfigBucketPermissionsCheck"
    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }

    actions = [
      "s3:GetBucketAcl",
      "s3:ListBucket",
    ]

    resources = [
      aws_s3_bucket.config_bucket.arn,
    ]
  }

  statement {
    sid = "AWSConfigBucketDelivery"
    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }

    actions = [
      "s3:PutObject",
      "s3:GetBucketLocation",
    ]

    resources = [
      "${aws_s3_bucket.config_bucket.arn}/AWSLogs/${ACCOUNT_ID}/Config/*", # replace ACCOUNT_ID
    ]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"

      values = ["bucket-owner-full-control"]
    }
  }
}

resource "aws_s3_bucket_policy" "config_bucket_policy" {
  bucket = aws_s3_bucket.config_bucket.id
  policy = data.aws_iam_policy_document.config_bucket_policy.json
}

resource "aws_config_delivery_channel" "main" {
  name           = "AWS_CONFIG_DELIVERY_CHANNEL_NAME" # replace with your delivery channel name if needed
  s3_bucket_name = aws_s3_bucket.config_bucket.bucket

  # Preserve any existing settings (SNS topic, snapshot options, etc.) here,
  # mirroring what is currently configured in AWS:
  # s3_key_prefix   = "OPTIONAL_PREFIX"
  # sns_topic_arn   = "arn:aws:sns:REGION:ACCOUNT_ID:TOPIC_NAME"
  # config_snapshot_delivery_properties {
  #   delivery_frequency = "TwentyFour_Hours"
  # }
}

# Note: Terraform manages the entire delivery channel object; any settings omitted
# from aws_config_delivery_channel.main will be removed on apply (similar to the CLI warning).

terraform plan should show that aws_config_delivery_channel.main will have s3_bucket_name set to AWS_CONFIG_BUCKET_NAME (and create/update the S3 bucket and its policy if they do not already match).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

AWS Config Should Have S3 Bucket Configured

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: