Cloudtrail object lock s3 buckets remediation

Using Console

To remediate the “Object Lock Feature Should Be Enabled” misconfiguration in AWS, you can follow the below steps:

Login to the AWS console.
Go to the S3 service.
Select the bucket for which you want to enable Object Lock feature.
Click on the “Properties” tab.
Scroll down to the “Object Lock” section.
Click on the “Edit” button.
Select the “Enable object lock” radio button.
Choose the “Retention period” as per your requirement. You can choose either “Governance” or “Compliance” mode.
Click on the “Save” button.

Once you have completed the above steps, the Object Lock feature will be enabled for the selected S3 bucket.

Using CLI

To remediate the “Object Lock Feature Should Be Enabled” misconfiguration in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine or EC2 instance.
Run the following command to enable object lock on a specific S3 bucket:
aws s3 put-bucket-object-lock-configuration --bucket <bucket-name> --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":<number-of-days>}}}'
Make sure to replace <bucket-name> with the name of the S3 bucket and <number-of-days> with the number of days for which the objects should be locked.
Verify that the object lock feature has been enabled by running the following command:
aws s3 get-bucket-object-lock-configuration --bucket <bucket-name>
This should return the object lock configuration for the specified bucket.

Repeat these steps for any other S3 buckets that need to have object lock enabled.

Using Python

To remediate the “Object Lock Feature Should Be Enabled” misconfiguration in AWS using Python, you can use the following steps:

Import the necessary AWS SDK libraries in your Python code. You can use the boto3 library for this.

import boto3

Create an AWS S3 client object using the boto3.client() method.

s3 = boto3.client('s3')

Use the put_bucket_object_lock_configuration() method of the S3 client object to enable the object lock feature for your S3 bucket. This method takes the following parameters:

Bucket: The name of the S3 bucket for which you want to enable the object lock feature.
ObjectLockConfiguration: A dictionary that contains the configuration settings for the object lock feature. In this case, we need to set the ObjectLockEnabled key to Enabled.

response = s3.put_bucket_object_lock_configuration(
    Bucket='your-bucket-name',
    ObjectLockConfiguration={
        'ObjectLockEnabled': 'Enabled'
    }
)

Check the response of the put_bucket_object_lock_configuration() method to ensure that the object lock feature has been enabled successfully.

if response['ResponseMetadata']['HTTPStatusCode'] == 200:
    print('Object lock feature has been enabled for your S3 bucket.')
else:
    print('Error enabling object lock feature for your S3 bucket.')

By following these steps, you should be able to remediate the “Object Lock Feature Should Be Enabled” misconfiguration in AWS using Python.

Using Terraform

# S3 bucket used by CloudTrail with Object Lock enabled.
# NOTE: Setting object_lock_enabled = true forces bucket replacement.
# You cannot turn on Object Lock for an existing bucket; create a new one and
# repoint the CloudTrail trail to it.

resource "aws_s3_bucket" "cloudtrail_logs" {
  bucket              = "YOUR_CLOUDTRAIL_LOG_BUCKET_NAME"
  object_lock_enabled = true
}

resource "aws_s3_bucket_versioning" "cloudtrail_logs" {
  bucket = aws_s3_bucket.cloudtrail_logs.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_object_lock_configuration" "cloudtrail_logs" {
  bucket = aws_s3_bucket.cloudtrail_logs.id

  rule {
    default_retention {
      mode  = "COMPLIANCE"   # or "GOVERNANCE" per your compliance needs
      days  = 365            # or use years = N
      # years = 1
    }
  }
}

# Example CloudTrail pointing to the Object-Lock-enabled bucket
resource "aws_cloudtrail" "trail" {
  name                          = "YOUR_TRAIL_NAME"
  s3_bucket_name                = aws_s3_bucket.cloudtrail_logs.bucket
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  is_organization_trail         = false

  # add any other required arguments for your environment
}

This change forces replacement of the S3 bucket (object_lock_enabled = true is immutable), which implies creating a new bucket, updating the CloudTrail trail to use it, and handling any data migration you require.To verify, terraform plan should show:

a new aws_s3_bucket with object_lock_enabled = true,
new aws_s3_bucket_versioning and aws_s3_bucket_object_lock_configuration attached to that bucket,
an update to aws_cloudtrail so s3_bucket_name points at the new bucket.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Cloudtrail object lock s3 buckets remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation