CreateJob

​

Event Information

• The CreateJob event in AWS for S3 refers to the initiation of a job to perform a specific action on an S3 object or a set of objects.
• This event is typically triggered when a user or an application creates a job using the AWS S3 API or the AWS Management Console.
• The CreateJob event can be used to track and monitor the progress of various operations such as data transfers, data transformations, or data analysis tasks performed on S3 objects.

​

Examples

• Unauthorized access: If the appropriate access controls are not in place, an unauthorized user may be able to create a job in S3, potentially leading to data breaches or unauthorized modifications to objects stored in S3.
• Data leakage: If the job creation process does not enforce proper encryption and data protection measures, sensitive data may be exposed during the job creation process, increasing the risk of data leakage.
• Malicious code execution: If the job creation process does not include proper security checks, an attacker may be able to inject and execute malicious code, potentially compromising the underlying infrastructure or gaining unauthorized access to other resources within the AWS environment.

​

Remediation

​

Using Console

1. Enable versioning for S3 buckets:

   • Open the AWS Management Console and navigate to the S3 service.
   • Select the desired bucket and click on the “Properties” tab.
   • Under the “Versioning” section, click on “Edit”.
   • Select “Enable versioning” and click on “Save changes”.

2. Enable server access logging for S3 buckets:

   • Open the AWS Management Console and navigate to the S3 service.
   • Select the desired bucket and click on the “Properties” tab.
   • Under the “Server access logging” section, click on “Edit”.
   • Select “Enable logging” and provide the target bucket where the logs will be stored.
   • Click on “Save changes”.

3. Enable default encryption for S3 buckets:

   • Open the AWS Management Console and navigate to the S3 service.
   • Select the desired bucket and click on the “Properties” tab.
   • Under the “Default encryption” section, click on “Edit”.
   • Select the desired encryption option (e.g., SSE-S3, SSE-KMS, or SSE-C) and provide the necessary details.
   • Click on “Save changes”.

​

Using CLI

1. Enable versioning for S3 buckets:

   • Command: aws s3api put-bucket-versioning --bucket <bucket-name> --versioning-configuration Status=Enabled

2. Restrict public access to S3 buckets:

   • Command: aws s3api put-public-access-block --bucket <bucket-name> --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

3. Enable server-side encryption for S3 buckets:

   • Command: aws s3api put-bucket-encryption --bucket <bucket-name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'

​

Using Python

1. Enable server-side encryption for S3 buckets:
   • Use the boto3 library in Python to interact with the AWS S3 service.
   • Iterate through all the S3 buckets using the list_buckets() method.
   • For each bucket, check if server-side encryption is enabled using the get_bucket_encryption() method.
   • If encryption is not enabled, use the put_bucket_encryption() method to enable server-side encryption.

import boto3

s3_client = boto3.client('s3')

def enable_s3_encryption():
    response = s3_client.list_buckets()
    buckets = response['Buckets']
    
    for bucket in buckets:
        bucket_name = bucket['Name']
        encryption = s3_client.get_bucket_encryption(Bucket=bucket_name)
        
        if 'ServerSideEncryptionConfiguration' not in encryption:
            s3_client.put_bucket_encryption(
                Bucket=bucket_name,
                ServerSideEncryptionConfiguration={
                    'Rules': [
                        {
                            'ApplyServerSideEncryptionByDefault': {
                                'SSEAlgorithm': 'AES256'
                            }
                        }
                    ]
                }
            )

2. Enable versioning for S3 buckets:
   • Use the boto3 library in Python to interact with the AWS S3 service.
   • Iterate through all the S3 buckets using the list_buckets() method.
   • For each bucket, check if versioning is enabled using the get_bucket_versioning() method.
   • If versioning is not enabled, use the put_bucket_versioning() method to enable versioning.

import boto3

s3_client = boto3.client('s3')

def enable_s3_versioning():
    response = s3_client.list_buckets()
    buckets = response['Buckets']
    
    for bucket in buckets:
        bucket_name = bucket['Name']
        versioning = s3_client.get_bucket_versioning(Bucket=bucket_name)
        
        if 'Status' not in versioning or versioning['Status'] != 'Enabled':
            s3_client.put_bucket_versioning(
                Bucket=bucket_name,
                VersioningConfiguration={
                    'Status': 'Enabled'
                }
            )

3. Enable logging for S3 buckets:
   • Use the boto3 library in Python to interact with the AWS S3 service.
   • Iterate through all the S3 buckets using the list_buckets() method.
   • For each bucket, check if logging is enabled using the get_bucket_logging() method.
   • If logging is not enabled, use the put_bucket_logging() method to enable logging.

import boto3

s3_client = boto3.client('s3')

def enable_s3_logging():
    response = s3_client.list_buckets()
    buckets = response['Buckets']
    
    for bucket in buckets:
        bucket_name = bucket['Name']
        logging = s3_client.get_bucket_logging(Bucket=bucket_name)
        
        if 'LoggingEnabled' not in logging:
            s3_client.put_bucket_logging(
                Bucket=bucket_name,
                BucketLoggingStatus={
                    'LoggingEnabled': {
                        'TargetBucket': 'your-logging-bucket',
                        'TargetPrefix': 'logs/'
                    }
                }
            )

Note: Replace 'your-logging-bucket' with the name of the bucket where you want to store the logs.