PutBucketVersioning

​

Event Information

• The PutBucketVersioning event in AWS for S3 refers to an action taken to enable or suspend versioning for a specific S3 bucket.
• When this event occurs, it indicates that the versioning configuration of the bucket has been modified.
• Versioning in S3 allows you to keep multiple versions of an object in the bucket, providing protection against accidental deletion or overwrites.

​

Examples

1. Unauthorized access: If the PutBucketVersioning operation is misconfigured or improperly secured, it can potentially allow unauthorized users to enable versioning on an S3 bucket. This can lead to unauthorized access to previous versions of objects stored in the bucket, potentially exposing sensitive data.

2. Data leakage: Enabling versioning on an S3 bucket without proper access controls can result in data leakage. If an attacker gains access to the bucket, they can retrieve previous versions of objects, including sensitive or confidential information that was supposed to be deleted or overwritten.

3. Compliance violations: If versioning is enabled on an S3 bucket without proper controls and retention policies, it can lead to compliance violations. For example, if a regulated organization is required to delete data after a certain period, but versioning is enabled and previous versions are retained indefinitely, it can result in non-compliance with data retention regulations.

​

Remediation

​

Using Console

1. Enable versioning for S3 buckets:

   • Open the AWS Management Console and navigate to the S3 service.
   • Select the desired bucket and click on the “Properties” tab.
   • Under the “Versioning” section, click on the “Edit” button.
   • Select the “Enable versioning” option and click on “Save changes”.

2. Enable server access logging for S3 buckets:

   • Open the AWS Management Console and go to the S3 service.
   • Select the target bucket and click on the “Properties” tab.
   • Under the “Server access logging” section, click on the “Edit” button.
   • Enable the “Server access logging” option and specify the target bucket for storing access logs.
   • Click on “Save changes” to enable server access logging.

3. Enable default encryption for S3 buckets:

   • Open the AWS Management Console and navigate to the S3 service.
   • Select the desired bucket and click on the “Properties” tab.
   • Under the “Default encryption” section, click on the “Edit” button.
   • Enable the “Default encryption” option and select the desired encryption type (e.g., SSE-S3, SSE-KMS).
   • Click on “Save changes” to enable default encryption for the bucket.

​

Using CLI

1. Enable versioning for S3 buckets:

   • Command: aws s3api put-bucket-versioning --bucket <bucket-name> --versioning-configuration Status=Enabled

2. Restrict public access to S3 buckets:

   • Command: aws s3api put-public-access-block --bucket <bucket-name> --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

3. Enable server-side encryption for S3 buckets:

   • Command: aws s3api put-bucket-encryption --bucket <bucket-name> --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'

​

Using Python

1. Enable server-side encryption for S3 buckets:
   • Use the boto3 library in Python to interact with AWS services.
   • Use the put_bucket_encryption method to enable server-side encryption for an S3 bucket.
   • Specify the encryption configuration with the appropriate encryption algorithm and key.

import boto3

def enable_s3_bucket_encryption(bucket_name, kms_key_id):
    s3_client = boto3.client('s3')
    encryption_config = {
        'Rules': [
            {
                'ApplyServerSideEncryptionByDefault': {
                    'SSEAlgorithm': 'aws:kms',
                    'KMSMasterKeyID': kms_key_id
                }
            }
        ]
    }
    s3_client.put_bucket_encryption(
        Bucket=bucket_name,
        ServerSideEncryptionConfiguration=encryption_config
    )

2. Enable versioning for S3 buckets:
   • Use the boto3 library in Python to interact with AWS services.
   • Use the put_bucket_versioning method to enable versioning for an S3 bucket.

import boto3

def enable_s3_bucket_versioning(bucket_name):
    s3_client = boto3.client('s3')
    s3_client.put_bucket_versioning(
        Bucket=bucket_name,
        VersioningConfiguration={'Status': 'Enabled'}
    )

3. Enable logging for S3 buckets:
   • Use the boto3 library in Python to interact with AWS services.
   • Use the put_bucket_logging method to enable logging for an S3 bucket.
   • Specify the target bucket and prefix for the log files.

import boto3

def enable_s3_bucket_logging(bucket_name, target_bucket, target_prefix):
    s3_client = boto3.client('s3')
    logging_config = {
        'LoggingEnabled': {
            'TargetBucket': target_bucket,
            'TargetPrefix': target_prefix
        }
    }
    s3_client.put_bucket_logging(
        Bucket=bucket_name,
        BucketLoggingStatus=logging_config
    )
}