An S3 bucket must have a lifecycle configuration misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_61
Category - Subcategory	Logging - Retention
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule detects whether an S3 bucket in AWS has a lifecycle configuration or not. A lifecycle configuration on an S3 bucket helps to manage objects so they can be automatically transitioned to other storage classes or expire after a certain period. This is crucial for cost effective data management and storage optimization.

How to Fix

Resource: aws_s3_bucket

• Arguments: lifecycle_rule

To fix the issue, it is needed to configure a lifecycle_rule under the respective S3 bucket in your terraform file specifying the id, status, prefix, transition, and expiration.

The above code defines a lifecycle configuration rule for the S3 bucket "bucket". The rule "expire" applies to objects with keys beginning with "logs/", transitions those objects to the STANDARD_IA storage class after 30 days, and then expires the objects 90 days after creation. This helps to reduce costs and ensure correct object lifecycle management. [source,go]

resource "aws_s3_bucket" "bucket" { bucket = "bucket" acl = "private”

lifecycle_rule { id = "expire" status = "Enabled" prefix = "logs/" transition { days = 30 storage_class = "STANDARD_IA" } expiration { days = 90 } } }