> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Dns compliant s3 bucket names remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the misconfiguration in AWS:

        1. Log in to your AWS Management Console.
        2. Navigate to the S3 service.
        3. Select the bucket that is non-compliant with DNS naming conventions.
        4. Click on the "Properties" tab.
        5. Scroll down to the "Static Website Hosting" section.
        6. In the "Static website hosting" section, click on the "Edit" button.
        7. In the "Edit static website hosting" dialog box, select the "Use this bucket to host a website" checkbox.
        8. In the "Index document" field, enter a valid index document name (e.g. index.html).
        9. In the "Error document" field, enter a valid error document name (e.g. error.html).
        10. Click on the "Save changes" button.

        Once you have completed the above steps, your S3 bucket will be compliant with DNS naming conventions. It is important to note that you should choose a bucket name that is unique, easy to remember and relevant to your organization.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the S3 bucket name non-compliance issue, you need to follow the below steps using AWS CLI:

        1. Open your terminal or command prompt and install the AWS CLI (if not already installed) by following the instructions provided in the AWS documentation.

        2. After installing AWS CLI, open your terminal or command prompt and enter the following command:

        ```
        aws s3api put-bucket-acl --bucket BUCKET_NAME --acl public-read
        ```

        Note: Replace BUCKET\_NAME with the name of your S3 bucket.

        3. Once the above command is executed successfully, enter the following command to rename the non-compliant bucket name:

        ```
        aws s3api copy-object --copy-source BUCKET_NAME/ --bucket NEW_BUCKET_NAME --metadata-directive REPLACE --metadata x-amz-meta-original-name=BUCKET_NAME
        ```

        Note: Replace BUCKET\_NAME with the name of your non-compliant S3 bucket and NEW\_BUCKET\_NAME with the new DNS-compliant name you want to give to your S3 bucket.

        4. After executing the above command successfully, enter the following command to delete the non-compliant bucket:

        ```
        aws s3api delete-bucket --bucket BUCKET_NAME
        ```

        Note: Replace BUCKET\_NAME with the name of your non-compliant S3 bucket.

        5. Finally, verify that the new bucket name is DNS-compliant by entering the following command:

        ```
        aws s3api head-bucket --bucket NEW_BUCKET_NAME
        ```

        If the above command returns no error, it means that your S3 bucket name is now DNS-compliant.
      </Accordion>

      <Accordion title="Using Python">
        To remediate this misconfiguration in AWS using Python, you can follow these steps:

        1. Install the AWS SDK for Python (boto3) using pip:

        ```
        pip install boto3
        ```

        2. Create an AWS S3 client object:

        ```python theme={null}
        import boto3

        s3 = boto3.client('s3')
        ```

        3. List all the S3 buckets in your AWS account:

        ```python theme={null}
        response = s3.list_buckets()

        for bucket in response['Buckets']:
            print(bucket['Name'])
        ```

        4. Check if the bucket names are DNS-compliant:

        ```python theme={null}
        import re

        for bucket in response['Buckets']:
            bucket_name = bucket['Name']
            if not re.match("^[a-z0-9][a-z0-9\-]{1,61}[a-z0-9]$", bucket_name):
                print(f"Bucket name {bucket_name} is not DNS-compliant")
        ```

        5. If a bucket name is not DNS-compliant, rename the bucket:

        ```python theme={null}
        new_bucket_name = "new-dns-compliant-bucket-name"
        s3.copy_object(Bucket=new_bucket_name, CopySource={"Bucket": bucket_name, "Key": ""})
        s3.delete_object(Bucket=bucket_name, Key="")
        s3.delete_bucket(Bucket=bucket_name)
        ```

        Note: Make sure to replace "new-dns-compliant-bucket-name" with a DNS-compliant bucket name of your choice. Also, be aware that renaming a bucket can have implications for any applications or services that rely on the original bucket name.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # New S3 bucket with a DNS-compliant name
        resource "aws_s3_bucket" "new_dns_compliant" {
          bucket = "NEW_DNS_COMPLIANT_BUCKET_NAME" # replace with a globally unique, DNS-compliant name
          force_destroy = true                     # WARNING: allows Terraform to delete non-empty buckets
        }

        # (Optional) Re-apply bucket configuration from the old bucket
        # Example: versioning, policies, etc. – copy from the old bucket's Terraform
        resource "aws_s3_bucket_versioning" "new_dns_compliant" {
          bucket = aws_s3_bucket.new_dns_compliant.id

          versioning_configuration {
            status = "Enabled"
          }
        }

        resource "aws_s3_bucket_policy" "new_dns_compliant" {
          bucket = aws_s3_bucket.new_dns_compliant.id
          policy = data.aws_iam_policy_document.new_dns_compliant_policy.json
        }

        data "aws_iam_policy_document" "new_dns_compliant_policy" {
          # Copy and adjust the old bucket policy here, updating all references
          # from OLD_BUCKET_NAME to NEW_DNS_COMPLIANT_BUCKET_NAME
          statement {
            actions   = ["s3:GetObject"]
            resources = ["arn:aws:s3:::NEW_DNS_COMPLIANT_BUCKET_NAME/*"]
            principals {
              type        = "AWS"
              identifiers = ["PRINCIPAL_ARN"]
            }
          }
        }
        ```

        You cannot rename an existing S3 bucket in Terraform; bucket names are immutable. To align with the verified CLI remediation, you must:

        1. Add the new `aws_s3_bucket` (and any related config resources) with a DNS‑compliant name, and update **all** Terraform references, IAM policies, and application configuration to use `NEW_DNS_COMPLIANT_BUCKET_NAME`.
        2. Migrate objects between buckets out‑of‑band (e.g., using `aws s3 sync s3://OLD_BUCKET_NAME s3://NEW_DNS_COMPLIANT_BUCKET_NAME` as in the CLI fix). Terraform does not provide an equivalent data-copy resource.
        3. Remove the old bucket resource (`aws_s3_bucket.old` and related resources) from Terraform so that the next `terraform apply` issues `DeleteBucket`/`DeleteObject*` API calls and destroys the old bucket. With `force_destroy = true`, this is DESTRUCTIVE and IRREVERSIBLE.

        This change forces replacement of the bucket: the old bucket is destroyed and a completely new bucket is created with a compliant name.

        Verification:\
        After you introduce the new bucket resource and remove the old one, `terraform plan` should show:

        * `+` creation of `aws_s3_bucket.new_dns_compliant` (and its related config resources), and
        * `-` destruction of the old `aws_s3_bucket` and its related resources.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>