Quick Info
| Plugin Title | CloudTrail Bucket Delete Policy |
| Cloud | AWS |
| Category | CloudTrail |
| Description | Ensures CloudTrail logging bucket has a policy to prevent deletion of logs without an MFA token |
| More Info | To provide additional security, CloudTrail logging buckets should require an MFA token to delete objects |
| AWS Link | http://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete |
| Recommended Action | Enable MFA delete on the CloudTrail bucket |
Detailed Remediation Steps
- Log into the AWS Management Console.
- Select the “Services” option and search for “CloudTrail”.
- In the “Dashboard” panel click on “View trails” button.
- Select the “trail” that needs to be verified under “Name” column.
- Scroll down and under the “Storage location” option check the S3 bucket used to store log data.
- Go to “Services” and search for “S3” to go into S3 buckets dashboard.
- Select the “S3 bucket” used to store data log in CloudTrail.
- Enabling MFA using AWS Management Console is not supported as of now. MFA can be enabled using AWS API. Configure “AWS CLI” with your own “AWS Key Id” and “AWS Secret Key” as well as configure MFA for your root account.
- Follow the commands to “Enable MFA”.
- To list buckets in AWS account: aws s3api list-buckets –query ‘Buckets[*].Name’
- To verify if the selected “CloudTrail bucket” has object versioning enabled : aws s3api get-bucket-versioning –bucket shukla008
- To enable “MFA Delete” and “Versioning” of the selected “CloudTrail bucket” : aws s3api put-bucket-versioning –bucket shukla008 –versioning-configuration Status=Enabled,MFADelete=Enabled –mfa ‘arn:aws:iam::10260454563607:mfa/root-account-mfa-device 531098’
- To verify if “MFA Delete” and “Versioning” of the selected “CloudTrail bucket” is enabled. It returns output as Enabled Enabled if “MFA and Versioning” are “Enabled” : aws s3api get-bucket-versioning –bucket shukla00
- To list select “CloudTrail bucket” object versions : aws s3api list-object-versions –bucket shukla008
- To examine try and delete the S3 object version without “MFA” token : aws s3api delete-object –bucket shukla008 –version-id “HBU7m.mOKZhxuXXDl5Y9c1Iu6.XWQkxu” –key demo.txt
- MFA Delete is enabled on selected “CloudTrail bucket”.