S3 buckets do not have event notifications enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_62
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

This rule detects if the S3 bucket event notifications are not enabled in AWS settings.

How to Fix

Resource: aws_s3_bucket, aws_s3_bucket_notification

• Arguments: queue, lambda_function, topic

The issue can be fixed by enabling event notifications for the S3 bucket. You can do it by using the aws_s3_bucket_notification resource where you can specify the type of destination (Amazon SQS, Amazon SNS, or AWS Lambda) where you want Amazon S3 to publish the event.

Secure code example:

The above code is secure as it enables event notifications for the S3 bucket and specifies Amazon SNS as the destination where Amazon S3 will publish the event. [source,go]

resource "aws_s3_bucket" "bucket" { bucket = "bucket" }

resource "aws_sns_topic" "bucket_notifications" { name = "bucket-notifications" }

resource "aws_s3_bucket_notification" "bucket_notification" { bucket = aws_s3_bucket.bucket.id

topic { topic_arn = aws_sns_topic.bucket_notifications.arn events = ["s3:ObjectCreated:*"] filter_prefix = "logs/" } }