S3 Cloud Custodian

Question

I am writing a cloud custodian policy to find the s3 buckets which are not encrypted on creation- send an email to slack for 5 days- then encrypt on the 6th day. I have figured out the component on emailing to slack. But not able to put the logic to mark the S3 bucket for encryption and then encrypt on current date. Any help is appreciated

Answer 1

Consider using lambda as a custom AWS Config Rule, or create a lambda that is triggered off a compliance change to the standard rule: S3 bucket encryption is enabled.

For either, the lambda identifies the bucket and applies the encryption setting.

The tricky part is applying this on the 6th day. Applying immediately would provide better enforcement of the policy. To do this will require separate storage of the bucket ARN and the date to apply the encryption setting and a scheduler to run the function that either sends another Slack message or applies encryption.

For the first approach there is documentation for creating custom rules:

1. Guide: How to Audit Your AWS Resources for Security Compliance by Using Custom AWS Config Rules
2. Documentation

For the second approach, create a CloudWatch rule with

1. Service Name: Config
2. Event Type: Config Rules Compliance Change
3. Target: Your lambda function