Amazon S3 bucket compliance using AWS Config Auto Remediation
Published: 2022-08-29 08:14:17

This post describes how to use the AWS Config Auto Remediation feature to auto remediate any non-compliant S3 buckets using the following AWS Config rules
**_s3-bucket-server-side-encryption-enabled
s3-bucket-level-public-access-prohibited_**
These AWS Config rules act as controls to prevent any non-compliant S3 activities.

## Prerequisites
**S3 Bucket**
Create one S3 bucket without Block public access and Default encryption Disabled (bucket settings) assigned below policy to bucket by replacing your account id and bucket name.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSConfigBucketPermissionsCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "config.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::example-s3-bucket",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceAccount": "999999999999"
                }
            }
        },
        {
            "Sid": "AWSConfigBucketExistenceCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "config.amazonaws.com"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::example-s3-bucket",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceAccount": "999999999999"
                }
            }
        },
        {
            "Sid": "AWSConfigBucketDelivery",
            "Effect": "Allow",
            "Principal": {
                "Service": "config.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::example-s3-bucket/AWSLogs/999999999999/Config/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceAccount": "999999999999",
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        }
    ]
}

## Service-Linked Roles
**AmazonSSMAutomationRole**
Search Simple IAM from search services and click on IAM  to move on.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lqhatk06iez5e3p9nonf.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/maa90cdj9o28etjln7ue.png)Change trust policy by adding principal as SSM click next on bottom
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/631xg7linjh7rbm9jkin.png)Select permission polices 
Select and select both policies 
AmazonS3FullAccess (SSM access some other actions for S3 since its demo can assign full access)
AmazonSSMAutomationRole
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dybvhdhr84urswn44is8.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w3u0xfbexspi2ltkh5o1.png)Click on next button give role name and description and click on create role
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nxw2iigwynwvrtg0c5u3.png)**AWSServiceRoleForConfig**  
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o2g0vbcwpym65xmlg9ti.png)Click next from bottom
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j7imncjiyjxzk6z0pad8.png)Click next review details and click create role once roles will be crated will be available as below
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3fbgb0yc4uh32276khuc.png)**SNS Topic**   
Search Simple Notification Service (SNS) from search services and click on (SNS) to move on.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sh5gkyr3fp15wg7744bk.png)You will land here if already you did not define and SNS topic
In my case I named as AwsConfigRulesSNSTopic click next step
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m3tn8pjgtoc6cbwi366q.png)Leave all setting default and click on create topic
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/85nb6xf0r08co85e3b8z.png)Once topic created create subscription ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nbuucxnkzbr85rsr50pz.png)Select protocol as Email provide your email and proceed to create subscription![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/095h2ii2x8up0h26byzb.png)Confirm you subscription from provided email address![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0l6tapukqnnixfx1gq60.png)Let's start configuring AWS Config 
Search Config from search services and click on Config to move on. 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q5jwxc89h5mhvd36twkc.png)You will land here if you don’t created any config rule for selected region and click get started
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t5hksi0e7g8dzk7od00p.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1h5tuicrxtsvf06s9j8j.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/igf9zbwu9gmakdtvynzo.png)Select rule to check
s3-bucket-level-public-access-prohibited
s3-bucket-server-side-encryption-enabled
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u2m14czpzdbzqck9kmt5.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/50r6g5klh5cy1m3nnbe8.png)Once Rule created go to dashboard check rules
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dqc9a2aqzbxc24q6f13o.png)see both rules are noncompliant because my S3 bucket awsconfiglogandruletest have Block all public access off and server side encryption is disabled.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/asycylmwlaoiokukdj96.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0n04q6ki2d8qtq4avgxk.png)Here we identified noncompliant resource its time to remediate 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2hrhtlqszc1yundt4khe.png)Default remediation method is manual select automatic
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c93h379v7zy0nu6rroxw.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rvwnidy6pbawanqzlfek.png)Once you save remediation right after next change to bucket configuration noncompliant resources will automatically become complaint 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gwpe8b77qgtkgwfr4s08.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j0bkbwdw2h419shg7w58.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cz8n1gaxvl7vfvm2w3ys.png)To delete all config rules first delete remediation actions 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j1vg7wu2egm5nmio6q8d.png)![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5diqbgyau8ssj9cptuai.png)Once rule deleted
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9ttkmaomumf3cfea5ydo.png)Execute this command via AWS CLI in my case used Cloud9 to access AWS CLI
aws configservice delete-configuration-recorder --configuration-recorder-name default
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/azyjzlohqnpceq35cvpp.png)Search Config from search services and click on Config to move on.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l4apa8vbkhb00s899n10.png)Instead to go to config dashboard you land on this page this means all config setting deleted.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dqro1mk04ojx30sj098z.png)
**Happy Learning**