s3-estate-calibration-auditor

Name: s3-estate-calibration-auditor
Author: anyshift-io

16stars0forks

How to install s3-estate-calibration-auditor?

anyshift-io/sre-skills/s3-estate-calibration-auditor

$npx -y skills add anyshift-io/sre-skills --skill s3-estate-calibration-auditor

Installs into the current project.

Summary

Audit an estate of AWS S3 buckets for the one bucket that is genuinely publicly or cross-account exposed, without over-flagging the many buckets that READ as exposed but are neutralised. Resolves each bucket's EFFECTIVE verdict by composing four layers (Block Public Access x buck

Files · 1

View on GitHub

SKILL.md

1	# s3-estate-calibration-auditor
2
3	Effective-exposure audit skill for an estate of AWS S3 buckets. Takes the config layers
4	for every bucket in the estate (`public-access-block.json`, `bucket-policy.json`,
5	`bucket-acl.json`, and `access-points.json` where present), resolves each bucket's
6	effective verdict by composing all four layers, then answers one question a per-layer
7	read cannot: across 8-12 buckets that mostly READ as exposed, which one is genuinely
8	live, and is the estate otherwise clean. It returns the live bucket as the headline,
9	ranked by severity, with a fix, then names exactly where the bucket configs stop being
10	able to answer the question.
11
12	Effective S3 exposure is a join across four layers that each get read wrong one at a
13	time. A public-looking bucket policy is inert under RestrictPublicBuckets; a cross-account
14	grant survives BPA-all-on; a public-group ACL is dead under IgnorePublicAcls but a
15	cross-account canonical user beside it is not; a clean bucket can still be public through
16	an access point. In an estate, the trap doubles: several buckets carry a Principal '*'
17	policy, an AllUsers ACL, or a wide-open look that is genuinely neutralised, and exactly
18	one bucket carries a real live grant that reads just like its neutralised siblings. This
19	skill composes the layers per bucket instead of clearing each layer in isolation, then
20	calibrates the estate: it does not over-flag the neutralised baits, and it does not miss
21	the buried needle.
22
23	## When to invoke
24
25	- An agent is asked to review an S3 bucket fleet for public exposure, cross-account
26	access, or "is anything in this account public."
27	- An estate is being shipped or changed and the question is whether any bucket is
28	effectively exposed, not just whether a Principal '*' or an AllUsers grant appears
29	somewhere in the configs.
30	- An estate looks exposed (several Principal '*' policies, AllUsers ACLs) and the claim
31	"but BPA is on / it is scoped" needs to be confirmed against the effective verdict
32	rather than taken on trust.
33	- An estate looks locked down (BPA all on everywhere) and the claim "the account is
34	closed" needs to be checked against the cross-account grants BPA does not touch.
35
36	## What this skill reads, and what it does not
37
38	It reads the static configuration of an estate of buckets: per bucket, any subset of
39	the Block Public Access booleans, the bucket policy, the bucket ACL, and the access
40	points. Those are S3 control-plane reads (`get-public-access-block`, `get-bucket-policy`,
41	`get-bucket-acl`, `list-access-points` + `get-access-point-policy`). That is the entire
42	input. The audit is correct and complete for what the bucket configs can tell you, and
43	it is explicit about the rest. Reachability-on-paper is not exposure-in-fact, and every
44	audit ends by naming the joins it cannot make:
45
46	- It does not see per-object ACLs. An individual object can carry its own
47	public-read grant even when the bucket is private. Join: bucket config to its per-object
48	ACLs.
49	- It does not see CloudFront / CDN fronting. A bucket can be private while its data
50	is served publicly through a CloudFront distribution with Origin Access Control. Join:
51	bucket to its CDN distribution.
52	- It does not contain the privileges of a trusted principal. A cross-account or
53	conditional grant only matters in proportion to what the trusted account/role can do and
54	whether it re-shares onward, which lives in that account. Join: this bucket to the
55	identity policies of the principals it trusts.
56	- It does not see **VPC-endpoint polic

People who liked this also viewed

6 picks

Type

s3-estate-calibration-auditor

16stars0forks

View on GitHub

How to install s3-estate-calibration-auditor?

anyshift-io/sre-skills/s3-estate-calibration-auditor

$npx -y skills add anyshift-io/sre-skills --skill s3-estate-calibration-auditor

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# s3-estate-calibration-auditor
2
3	Effective-exposure audit skill for an estate of AWS S3 buckets. Takes the config layers
4	for every bucket in the estate (`public-access-block.json`, `bucket-policy.json`,
5	`bucket-acl.json`, and `access-points.json` where present), resolves each bucket's
6	effective verdict by composing all four layers, then answers one question a per-layer
7	read cannot: across 8-12 buckets that mostly READ as exposed, which one is genuinely
8	live, and is the estate otherwise clean. It returns the live bucket as the headline,
9	ranked by severity, with a fix, then names exactly where the bucket configs stop being
10	able to answer the question.
11
12	Effective S3 exposure is a join across four layers that each get read wrong one at a
13	time. A public-looking bucket policy is inert under RestrictPublicBuckets; a cross-account
14	grant survives BPA-all-on; a public-group ACL is dead under IgnorePublicAcls but a
15	cross-account canonical user beside it is not; a clean bucket can still be public through
16	an access point. In an estate, the trap doubles: several buckets carry a Principal '*'
17	policy, an AllUsers ACL, or a wide-open look that is genuinely neutralised, and exactly
18	one bucket carries a real live grant that reads just like its neutralised siblings. This
19	skill composes the layers per bucket instead of clearing each layer in isolation, then
20	calibrates the estate: it does not over-flag the neutralised baits, and it does not miss
21	the buried needle.
22
23	## When to invoke
24
25	- An agent is asked to review an S3 bucket fleet for public exposure, cross-account
26	access, or "is anything in this account public."
27	- An estate is being shipped or changed and the question is whether any bucket is
28	effectively exposed, not just whether a Principal '*' or an AllUsers grant appears
29	somewhere in the configs.
30	- An estate looks exposed (several Principal '*' policies, AllUsers ACLs) and the claim
31	"but BPA is on / it is scoped" needs to be confirmed against the effective verdict
32	rather than taken on trust.
33	- An estate looks locked down (BPA all on everywhere) and the claim "the account is
34	closed" needs to be checked against the cross-account grants BPA does not touch.
35
36	## What this skill reads, and what it does not
37
38	It reads the static configuration of an estate of buckets: per bucket, any subset of
39	the Block Public Access booleans, the bucket policy, the bucket ACL, and the access
40	points. Those are S3 control-plane reads (`get-public-access-block`, `get-bucket-policy`,
41	`get-bucket-acl`, `list-access-points` + `get-access-point-policy`). That is the entire
42	input. The audit is correct and complete for what the bucket configs can tell you, and
43	it is explicit about the rest. Reachability-on-paper is not exposure-in-fact, and every
44	audit ends by naming the joins it cannot make:
45
46	- It does not see per-object ACLs. An individual object can carry its own
47	public-read grant even when the bucket is private. Join: bucket config to its per-object
48	ACLs.
49	- It does not see CloudFront / CDN fronting. A bucket can be private while its data
50	is served publicly through a CloudFront distribution with Origin Access Control. Join:
51	bucket to its CDN distribution.
52	- It does not contain the privileges of a trusted principal. A cross-account or
53	conditional grant only matters in proportion to what the trusted account/role can do and
54	whether it re-shares onward, which lives in that account. Join: this bucket to the
55	identity policies of the principals it trusts.
56	- It does not see **VPC-endpoint polic

People who liked this also viewed

6 picks

Type