AwsS3 ressources dans ASFF

Vous trouverez ci-dessous des exemples de syntaxe du format de recherche de AWS sécurité (ASFF) pour les AwsS3 ressources.

AWS Security Hub normalise les résultats provenant de diverses sources dans. ASFF Pour obtenir des informations générales surASFF, voirAWS Format de recherche de sécurité (ASFF).

AwsS3AccessPoint

AwsS3AccessPointfournit des informations sur un point d'accès Amazon S3. Les points d'accès S3 sont appelés points de terminaison réseau attachés à des compartiments S3 que vous pouvez utiliser pour effectuer des opérations sur des objets S3.

L'exemple suivant montre le format AWS de recherche de sécurité (ASFF) pour l'AwsS3AccessPointobjet. Pour consulter les descriptions des AwsS3AccessPoint attributs, consultez AWSs3 AccessPointDetails dans la AWS Security Hub API référence.

Exemple

"AwsS3AccessPoint": {
        "AccessPointArn": "arn:aws:s3:us-east-1:123456789012:accesspoint/asff-access-point",
        "Alias": "asff-access-point-hrzrlukc5m36ft7okagglf3gmwluquse1b-s3alias",
        "Bucket": "amzn-s3-demo-bucket",
        "BucketAccountId": "123456789012",
        "Name": "asff-access-point",
        "NetworkOrigin": "VPC",
        "PublicAccessBlockConfiguration": {
            "BlockPublicAcls": true,
            "BlockPublicPolicy": true,
            "IgnorePublicAcls": true,
            "RestrictPublicBuckets": true
        },
        "VpcConfiguration": {
            "VpcId": "vpc-1a2b3c4d5e6f1a2b3"
        }
}

AwsS3AccountPublicAccessBlock

AwsS3AccountPublicAccessBlockfournit des informations sur la configuration du bloc d'accès public Amazon S3 pour les comptes.

L'exemple suivant montre le format AWS de recherche de sécurité (ASFF) pour l'AwsS3AccountPublicAccessBlockobjet. Pour consulter les descriptions des AwsS3AccountPublicAccessBlock attributs, consultez AWSs3 AccountPublicAccessBlockDetails dans la AWS Security Hub API référence.

Exemple

"AwsS3AccountPublicAccessBlock": {
    "BlockPublicAcls": true,
    "BlockPublicPolicy": true,
    "IgnorePublicAcls": false,
    "RestrictPublicBuckets": true
}

AwsS3Bucket

L'AwsS3Bucketobjet fournit des informations sur un compartiment Amazon S3.

L'exemple suivant montre le format AWS de recherche de sécurité (ASFF) pour l'AwsS3Bucketobjet. Pour consulter les descriptions des AwsS3Bucket attributs, consultez AWSs3 BucketDetails dans la AWS Security Hub API référence.

Exemple

"AwsS3Bucket": {
    "AccessControlList": "{\"grantSet\":null,\"grantList\":[{\"grantee\":{\"id\":\"4df55416215956920d9d056aa8b99803a294ea221222bb668b55a8c6bca81094\",\"displayName\":null},\"permission\":\"FullControl\"},{\"grantee\":\"AllUsers\",\"permission\":\"ReadAcp\"},{\"grantee\":\"AuthenticatedUsers\",\"permission\":\"ReadAcp\"}",,
    "BucketLifecycleConfiguration": {
       "Rules": [
           {
               "AbortIncompleteMultipartUpload": {
                   "DaysAfterInitiation": 5
               },
               "ExpirationDate": "2021-11-10T00:00:00.000Z",
               "ExpirationInDays": 365,
               "ExpiredObjectDeleteMarker": false,
               "Filter": {
                   "Predicate": {
                       "Operands": [
                           {
                               "Prefix": "tmp/",
                               "Type": "LifecyclePrefixPredicate"
                           },
                           {
                               "Tag": {
                                   "Key": "ArchiveAge",
                                   "Value": "9m"
                               },
                               "Type": "LifecycleTagPredicate"
                           }
                       ],
                       "Type": "LifecycleAndOperator"
                   }
               },
               "ID": "Move rotated logs to Glacier",
               "NoncurrentVersionExpirationInDays": -1,
               "NoncurrentVersionTransitions": [
                   {
                       "Days": 2,
                       "StorageClass": "GLACIER"
                   }
               ],
               "Prefix": "rotated/",
               "Status": "Enabled",
               "Transitions": [
                   {
                       "Date": "2020-11-10T00:00:00.000Z",
                       "Days": 100,
                       "StorageClass": "GLACIER"
                   }
               ]
           }
       ]
    },
    "BucketLoggingConfiguration": {
    	"DestinationBucketName": "s3serversideloggingbucket-123456789012",
    	"LogFilePrefix": "buckettestreadwrite23435/"
    },
    "BucketName": "amzn-s3-demo-bucket",
    "BucketNotificationConfiguration": {
    	"Configurations": [{
    		"Destination": "arn:aws:lambda:us-east-1:123456789012:function:s3_public_write",
    		"Events": [
    			"s3:ObjectCreated:Put"
    		],
    		"Filter": {
    			"S3KeyFilter": {
    				"FilterRules": [
    				{
    					"Name": "AffS3BucketNotificationConfigurationS3KeyFilterRuleName.PREFIX",
    					"Value": "pre"
    				},
    				{
    					"Name": "AffS3BucketNotificationConfigurationS3KeyFilterRuleName.SUFFIX",
    					"Value": "suf"
    				},
    				]
    			}
    		},
    		"Type": "LambdaConfiguration"
    	}]
    },
    "BucketVersioningConfiguration": {
    	"IsMfaDeleteEnabled": true,
    	"Status": "Off"
    },
    "BucketWebsiteConfiguration": {
    	"ErrorDocument": "error.html",
    	"IndexDocumentSuffix": "index.html",
    	"RedirectAllRequestsTo": {
    		"HostName": "example.com",
    		"Protocol": "http"
    	},
    	"RoutingRules": [{
    		"Condition": {
    			"HttpErrorCodeReturnedEquals": "Redirected",
    			"KeyPrefixEquals": "index"
    					},
    		"Redirect": {
    			"HostName": "example.com",
    			"HttpRedirectCode": "401",
    			"Protocol": "HTTP",
    			"ReplaceKeyPrefixWith": "string",
    			"ReplaceKeyWith": "string"
    		}
    	}]
    },
    "CreatedAt": "2007-11-30T01:46:56.000Z",
    "ObjectLockConfiguration": {
    	"ObjectLockEnabled": "Enabled",
    	"Rule": {
    		"DefaultRetention": {
    			"Days": null,
    			"Mode": "GOVERNANCE",
    			"Years": 12
    		},
    	},
    },
    "OwnerId": "AIDACKCEVSQ6C2EXAMPLE",
    "OwnerName": "s3bucketowner",
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "BlockPublicPolicy": true,
        "IgnorePublicAcls": true,
        "RestrictPublicBuckets": true,
    },
    "ServerSideEncryptionConfiguration": {
        "Rules": [
            {
                "ApplyServerSideEncryptionByDefault": {
                    "SSEAlgorithm": "AES256",
                    "KMSMasterKeyID": "12345678-abcd-abcd-abcd-123456789012"
                }
            }
        ]
     }
}

AwsS3Object

L'AwsS3Objectobjet fournit des informations sur un objet Amazon S3.

L'exemple suivant montre le format AWS de recherche de sécurité (ASFF) pour l'AwsS3Objectobjet. Pour consulter les descriptions des AwsS3Object attributs, consultez AWSs3 ObjectDetails dans la AWS Security Hub API référence.

Exemple

"AwsS3Object": {
    "ContentType": "text/html",
    "ETag": "\"30a6ec7e1a9ad79c203d05a589c8b400\"",
    "LastModified": "2012-04-23T18:25:43.511Z",
    "ServerSideEncryption": "aws:kms",
    "SSEKMSKeyId": "arn:aws:kms:us-west-2:123456789012:key/4dff8393-e225-4793-a9a0-608ec069e5a7",
    "VersionId": "ws31OurgOOjH_HHllIxPE35P.MELYaYh"
}