In this lab, we will be deploying Amazon S3 Operational Best Practices with remediation actions conformance pack in an AWS Account. This pack contains following AWS Config Rules.
S3BucketPublicReadProhibitedwith Remediation Action
S3BucketPublicWriteProhibitedwith Remediation Action
S3BucketServerSideEncryptionEnabledwith Remediation Action
S3BucketLoggingEnabledwith Remediation Action
We will create prerequisite resources required for “Amazon S3 Operational Best Practices with Remediation Actions” conformance pack. This includes a service-linked role for Conformance Packs, a remediation action role, and an S3 logging bucket.
Important: deploying this Conformance Pack can disrupt access to data if installed in a production environment. Never deploy these conformance packs without proper testing in a safe test environment first!
Before proceeding, you must create a CloudFormation Stack that includes the resources required for this lab. Click here to deploy this Stack into your account:
Enter a stack name, and keep the settings with default values. Click through all the way to Create stack.
Before we can deploy the conformance pack, we will need to edit it. Conformance packs that AWS provides represent collated best practices, however they are not “one size fits all” and need some massaging before being leveraged.
First download the conformance pack template from this link.
Next edit this file so we can make it usable with your lab environment. You will need to replace the
<Account-Id> entries with the proper account number for your account (without dashes). You will find this entry on these lines:
Go to the Config Console, and then click on Conformance packs.
Click on Deploy conformance pack on the top right of the page.
Under template details, select Upload template, and then select the Upload a template. Click Choose file, upload your modified template, and finallly click Next.
Give the conformance pack a name that is meaningful to you.
This conformance pack will require a parameter to function. Click Add parameter and then add a new key called
s3serversideloggingbucketcreated by the CloudFormation stack you deployed in the prerequisites. Copy the name of the bucket into the value field.
Click Next, and finally click Deploy conformance pack.
We will check compliance status for each rule in conformance pack and associated resources. Conformance Packs can also be deployed to an AWS Organizations; however, in the interest of time it will only be discussed during this lab.
End of Lab Exercises
Thank you for using this lab.