S3 Bucket Without Versioning
- Query id: a227ec01-f97a-4084-91a4-47b350c1db54
- Query name: S3 Bucket Without Versioning
- Platform: CloudFormation
- Severity: Medium
- Category: Backup
- CWE: 326
- URL: Github
Description¶
S3 bucket should have versioning enabled
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - yaml file
Resources:
RecordServiceS3Bucket:
Type: 'AWS::S3::Bucket'
DeletionPolicy: Retain
Properties:
ReplicationConfiguration:
Role:
'Fn::GetAtt':
- WorkItemBucketBackupRole
- Arn
Rules:
- Destination:
Bucket:
'Fn::Join':
- ''
- - 'arn:aws:s3:::'
- 'Fn::Join':
- '-'
- - Ref: 'AWS::Region'
- Ref: 'AWS::StackName'
- replicationbucket
StorageClass: STANDARD
Id: Backup
Prefix: ''
Status: Enabled
Positive test num. 2 - yaml file
Resources:
RecordServiceS3Bucket2:
Type: 'AWS::S3::Bucket'
DeletionPolicy: Retain
Properties:
ReplicationConfiguration:
Role:
'Fn::GetAtt':
- WorkItemBucketBackupRole
- Arn
Rules:
- Destination:
Bucket:
'Fn::Join':
- ''
- - 'arn:aws:s3:::'
- 'Fn::Join':
- '-'
- - Ref: 'AWS::Region'
- Ref: 'AWS::StackName'
- replicationbucket
StorageClass: STANDARD
Id: Backup
Prefix: ''
Status: Enabled
VersioningConfiguration:
Status: Suspended
Positive test num. 3 - json file
{
"Resources": {
"RecordServiceS3Bucket": {
"Properties": {
"ReplicationConfiguration": {
"Role": {
"Fn::GetAtt": [
"WorkItemBucketBackupRole",
"Arn"
]
},
"Rules": [
{
"Id": "Backup",
"Prefix": "",
"Status": "Enabled",
"Destination": {
"Bucket": {
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Fn::Join": [
"-",
[
{
"Ref": "AWS::Region"
},
{
"Ref": "AWS::StackName"
},
"replicationbucket"
]
]
}
]
]
},
"StorageClass": "STANDARD"
}
}
]
}
},
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain"
}
}
}
Positive test num. 4 - json file
{
"Resources": {
"RecordServiceS3Bucket2": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain",
"Properties": {
"ReplicationConfiguration": {
"Rules": [
{
"Destination": {
"Bucket": {
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Fn::Join": [
"-",
[
{
"Ref": "AWS::Region"
},
{
"Ref": "AWS::StackName"
},
"replicationbucket"
]
]
}
]
]
},
"StorageClass": "STANDARD"
},
"Id": "Backup",
"Prefix": "",
"Status": "Enabled"
}
],
"Role": {
"Fn::GetAtt": [
"WorkItemBucketBackupRole",
"Arn"
]
}
},
"VersioningConfiguration": {
"Status": "Suspended"
}
}
}
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
Resources:
RecordServiceS3Bucket:
Type: 'AWS::S3::Bucket'
DeletionPolicy: Retain
Properties:
ReplicationConfiguration:
Role:
'Fn::GetAtt':
- WorkItemBucketBackupRole
- Arn
Rules:
- Destination:
Bucket:
'Fn::Join':
- ''
- - 'arn:aws:s3:::'
- 'Fn::Join':
- '-'
- - Ref: 'AWS::Region'
- Ref: 'AWS::StackName'
- replicationbucket
StorageClass: STANDARD
Id: Backup
Prefix: ''
Status: Enabled
VersioningConfiguration:
Status: Enabled
Negative test num. 2 - json file
{
"Resources": {
"RecordServiceS3Bucket": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain",
"Properties": {
"ReplicationConfiguration": {
"Rules": [
{
"Id": "Backup",
"Prefix": "",
"Status": "Enabled",
"Destination": {
"Bucket": {
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Fn::Join": [
"-",
[
{
"Ref": "AWS::Region"
},
{
"Ref": "AWS::StackName"
},
"replicationbucket"
]
]
}
]
]
},
"StorageClass": "STANDARD"
}
}
],
"Role": {
"Fn::GetAtt": [
"WorkItemBucketBackupRole",
"Arn"
]
}
},
"VersioningConfiguration": {
"Status": "Enabled"
}
}
}
}
}