Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne 11 January 2022 Release - AskJ1 Community
<main> <article class="userContent"> <p>January 11, 2022</p> <h2 data-id="aws-integration">AWS Integration</h2> <h2 data-id="description">Description</h2> <p>J1 has updated how it determines the AWS S3 bucket policy status to better align with what is presented in the AWS console.</p> <h2 data-id="changes">Changes</h2> <p>J1 has been using the <a rel="nofollow" href="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy-status.html">get-bucket-policy-status API</a> to retrieve the S3 bucket policy status for public and private settings. However, we have seen inconsistencies in this data when compared to the AWS console.</p> <p>The AWS console generates data through the access analyzer and there is no public API that we can use to directly retrieve this data.</p> <p>J1 has changed its logic so that it better aligns with the AWS console bucket access status. We believe this is a superior method for interpreting AWS bucket access.</p> <p>With this change, JupiterOne now presents:</p> <ul><li><p><code class="code codeInline" spellcheck="false" tabindex="0">public: true</code> when we definitively know that the S3 bucket is set to public per the bucket policy, ACLs, or the public block.</p></li> <li><p><code class="code codeInline" spellcheck="false" tabindex="0">public: false</code> when we definitively know that the S3 bucket is not public per the bucket policy, a review of the ACLs, or the public block.</p></li> <li><p><code class="code codeInline" spellcheck="false" tabindex="0">public: undefined</code> when cannot definivitely determine the bucket policy. This scenario happens when AWS access is presented as <code class="code codeInline" spellcheck="false" tabindex="0">Objects can be public</code> and we have no definitive evidence proving public true or false, OR we cannot connect to the AWS API to retrieve bucket access information.</p></li> </ul><p>Additionally, we are adding the <code class="code codeInline" spellcheck="false" tabindex="0">access</code> property to present additional information when the status is not <code class="code codeInline" spellcheck="false" tabindex="0">public: true</code> or <code class="code codeInline" spellcheck="false" tabindex="0">public: false</code>. This property allows a user to determine if there is a permission issue with JupiterOne's access (we believe this will be an edge case, but is possible), or if AWS is presenting <code class="code codeInline" spellcheck="false" tabindex="0">Objects can be public</code>. The <code class="code codeInline" spellcheck="false" tabindex="0">access</code> property will be set to either <code class="code codeInline" spellcheck="false" tabindex="0">access = ‘Bucket and objects not public'</code> or <code class="code codeInline" spellcheck="false" tabindex="0">access = 'Only authorized users of this account'</code>.</p> <p>While we believe this update presents a significant improvement in understanding your bucket access settings, if you notice inconsistencies in your data, please contact your customer success manager so that we can further tune and improve our logic.</p> <p>Finally, the default behavior uses the account-level <code class="code codeInline" spellcheck="false" tabindex="0">publicAccessBlock</code> to evaulate the access policy. Otherwise it evaluates based on the bucket-level <code class="code codeInline" spellcheck="false" tabindex="0">publicAccessBlock</code>.</p> <h2 data-id="customer-impact">Customer Impact</h2> <p>The <code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket.public</code> property accurately reflects the public status of the bucket. The new <code class="code codeInline" spellcheck="false" tabindex="0">access</code> property indicates the same text shown in the AWS console.</p> <p>If you have configured J1 alerts to monitor <code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket.public</code>, the alerts may be triggered next time you use the J1 AWS integration in cases where the value changes due to this improved analysis.</p> <p>Going forward, the access properties on S3 buckets in J1 should more closely align with what the AWS console displays.</p> </article> </main>
.png)