Skip to content

Commit 11fbe53

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#13580 from v-ezequielbi/AWSS3ServerAccessAndConfig
Fixed the vulnerability reported by the MSRC team in the AWSSEServerAccessAndConfig cloud formation template file related to the SQS and Bucket hardcoded default name.
2 parents 0f2ee86 + c53fbc5 commit 11fbe53

File tree

4 files changed

+77
-29
lines changed

4 files changed

+77
-29
lines changed

‎Solutions/AWS_AccessLogs/CloudFormationTemplates/AWSS3ServerAccessAndConfig.json‎

Lines changed: 73 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,18 @@
1010
},
1111
"BucketName": {
1212
"Type": "String",
13+
"MinLength": "3",
14+
"MaxLength": "63",
1315
"AllowedPattern": "^[a-z0-9][a-z0-9-.]{1,61}[a-z0-9]$",
14-
"Description": "Enter the name of the S3 bucket for storing server access logs.",
15-
"Default": "microsoft-sentinel-s3-server-logs"
16+
"ConstraintDescription": "S3 bucket name is required. Must be 3-63 characters, lowercase letters, numbers, dots, and hyphens only. Must start and end with letter or number.",
17+
"Description": "Enter a unique S3 bucket name for storing server access logs. Bucket name must be globally unique."
1618
},
1719
"SentinelSQSQueueName": {
18-
"Default": "MicrosoftSentinelS3ServerAccessLogsQueue",
1920
"Type": "String",
20-
"Description": "Enter the name for the SQS Queue."
21+
"MinLength": "1",
22+
"MaxLength": "80",
23+
"ConstraintDescription": "SQS queue name is required. Must be 1-80 characters.",
24+
"Description": "Enter a unique SQS queue name."
2125
},
2226
"SentinelWorkspaceId": {
2327
"Type": "String",
@@ -87,11 +91,11 @@
8791
"DeletionPolicy": "Retain",
8892
"Properties": {
8993
"BucketName": {
90-
"Fn::Sub": "${BucketName}"
94+
"Ref": "BucketName"
9195
},
9296
"LoggingConfiguration": {
9397
"DestinationBucketName": {
94-
"Fn::Sub": "${BucketName}"
98+
"Ref": "BucketName"
9599
},
96100
"LogFilePrefix": "server-logs/"
97101
},
@@ -137,12 +141,26 @@
137141
},
138142
"Action": "s3:PutObject",
139143
"Resource": {
140-
"Fn::Sub": "arn:aws:s3:::${BucketName}/*"
144+
"Fn::Join": [
145+
"",
146+
[
147+
{
148+
"Fn::GetAtt": [
149+
"S3Bucket",
150+
"Arn"
151+
]
152+
},
153+
"/*"
154+
]
155+
]
141156
},
142157
"Condition": {
143158
"ArnLike": {
144159
"aws:SourceArn": {
145-
"Fn::Sub": "arn:aws:s3:::${BucketName}"
160+
"Fn::GetAtt": [
161+
"S3Bucket",
162+
"Arn"
163+
]
146164
}
147165
}
148166
}
@@ -157,7 +175,18 @@
157175
},
158176
"Action": "s3:GetObject",
159177
"Resource": {
160-
"Fn::Sub": "arn:aws:s3:::${BucketName}/*"
178+
"Fn::Join": [
179+
"",
180+
[
181+
{
182+
"Fn::GetAtt": [
183+
"S3Bucket",
184+
"Arn"
185+
]
186+
},
187+
"/*"
188+
]
189+
]
161190
}
162191
}
163192
]
@@ -168,7 +197,7 @@
168197
"Type": "AWS::SQS::Queue",
169198
"Properties": {
170199
"QueueName": {
171-
"Fn::Sub": "${SentinelSQSQueueName}"
200+
"Ref": "SentinelSQSQueueName"
172201
}
173202
}
174203
},
@@ -179,42 +208,53 @@
179208
"Version": "2008-10-17",
180209
"Statement": [
181210
{
182-
"Sid": "StmtAllowReceiveDeleteChangeVisibility",
211+
"Sid": "AllowS3ToSendToQueue",
183212
"Effect": "Allow",
184213
"Principal": {
185214
"Service": "s3.amazonaws.com"
186215
},
187-
"Action": [
188-
"SQS:ReceiveMessage",
189-
"SQS:DeleteMessage",
190-
"SQS:ChangeMessageVisibility"
191-
],
216+
"Action": "SQS:SendMessage",
192217
"Resource": {
193218
"Fn::GetAtt": [
194219
"SentinelSQSQueue",
195220
"Arn"
196221
]
222+
},
223+
"Condition": {
224+
"StringEquals": {
225+
"aws:SourceAccount": {
226+
"Ref": "AWS::AccountId"
227+
}
228+
},
229+
"ArnLike": {
230+
"aws:SourceArn": {
231+
"Fn::Sub": "arn:aws:s3:::*"
232+
}
233+
}
197234
}
198235
},
199236
{
200-
"Sid": "AllowS3ToSendToQueue",
237+
"Sid": "AllowSentinelRoleToReadFromQueue",
201238
"Effect": "Allow",
202239
"Principal": {
203-
"Service": "s3.amazonaws.com"
240+
"AWS": {
241+
"Fn::GetAtt": [
242+
"SentinelWebIdentityBasedRole",
243+
"Arn"
244+
]
245+
}
204246
},
205-
"Action": "SQS:SendMessage",
247+
"Action": [
248+
"SQS:ReceiveMessage",
249+
"SQS:DeleteMessage",
250+
"SQS:ChangeMessageVisibility",
251+
"SQS:GetQueueUrl"
252+
],
206253
"Resource": {
207254
"Fn::GetAtt": [
208255
"SentinelSQSQueue",
209256
"Arn"
210257
]
211-
},
212-
"Condition": {
213-
"ArnLike": {
214-
"aws:SourceArn": {
215-
"Fn::Sub": "arn:aws:s3:::${BucketName}"
216-
}
217-
}
218258
}
219259
}
220260
]
@@ -237,6 +277,13 @@
237277
},
238278
"Description": "Role ARN for Sentinel Role that is inserted into Amazon Web Service S3 Connector in the Sentinel Data Connectors portal."
239279
},
280+
"S3BucketName": {
281+
"Value": {
282+
"Ref": "S3Bucket"
283+
},
284+
"Description": "S3 Bucket name where server access logs are stored.",
285+
"Condition": "CreateNewBucketCondition"
286+
},
240287
"SentinelSQSQueueURL": {
241288
"Description": "AWS SQS Queue URL that is inserted into Amazon Web Service S3 Connector in the Sentinel Data Connectors portal.",
242289
"Value": {

‎Solutions/AWS_AccessLogs/Package/3.0.2.zip‎

6.66 KB
Binary file not shown.

‎Solutions/AWS_AccessLogs/Package/mainTemplate.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
"email": "support@microsoft.com",
4848
"_email": "[variables('email')]",
4949
"_solutionName": "AWS_AccessLogs",
50-
"_solutionVersion": "3.0.1",
50+
"_solutionVersion": "3.0.2",
5151
"solutionId": "azuresentinel.azure-sentinel-solution-awsaccesslogs",
5252
"_solutionId": "[variables('solutionId')]",
5353
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
@@ -682,7 +682,7 @@
682682
"apiVersion": "2023-04-01-preview",
683683
"location": "[parameters('workspace-location')]",
684684
"properties": {
685-
"version": "3.0.1",
685+
"version": "3.0.2",
686686
"kind": "Solution",
687687
"contentSchemaVersion": "3.0.0",
688688
"displayName": "AWS_AccessLogs",

‎Solutions/AWS_AccessLogs/ReleaseNotes.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
**Version** | **Date Modified (DD-MM-YYYY)**| **ChangeHistory** |
22
|------------|-------------------------------|-------------------------------------------------------------------------------------------|
3+
| 3.0.2 | 05-02-2026 | Resolved vulnerability reported in AWS Access log in CloudFoundation template file. |
34
| 3.0.1 | 10-06-2025 | AWS S3 Server Access Log CCF **Data Connector** Moving to GA. |
4-
| 3.0.0 | 08-08-2025 | Initial Solution Release. <br/>New CCF **Data Connector** for AWS_AccessLogs. |
5+
| 3.0.0 | 08-08-2025 | Initial Solution Release. <br/>New CCF **Data Connector** for AWS_AccessLogs. |

0 commit comments

Comments
 (0)