Skip to content
GitLab Next
  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • GitLab GitLab
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 43,818
    • Issues 43,818
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 1,448
    • Merge requests 1,448
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages & Registries
    • Packages & Registries
    • Package Registry
    • Container Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Metrics
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • GitLab.org
  • GitLabGitLab
  • Issues
  • #199820
Closed
Open
Created Jan 30, 2020 by Sam Kerr@stkerr🎙Developer

MVC: Scan for public facing Amazon S3 buckets

Problem to solve

When hosting applications, it is possible that cloud infrastructure becomes misconfigured and assets intended to be privately accessible unintentionally become publicly accessible. A common, specific example of this is when AWS S3 storage buckets that are incorrectly shared publicly.

Intended users

Further details

Proposal

Request a read-only token to the user's AWS cluster and identify S3 buckets that are publicly accessible. Provide a list of all public buckets back to the users in a report. Re-scan the given AWS cluster periodically (proposal: every hour) and update the results.

User journey

  1. User goes to configuration screen
  2. User enters AWS token, any other needed settings, and enables scanning
  3. User views report page
  4. User takes action based on results (such as deleting the S3 bucket or updating its permissions)
    • We should guide the user to the relevant AWS page if possible but we don't need to fix their AWS statues from within GitLab for this issue

UX

  1. Scanning should happen periodically without requiring a user to manually trigger the scan. Scanning should also not require a code commit nor an MR.
  2. Report should live under a new section in Security & Compliance
  3. Report should list each AWS S3 bucket that is publicly accessible and any relevant metadata.
    • Coordinate with UX on designs for this screen. Sketch ideas in the Designs tab

Permissions and Security

Documentation

Availability & Testing

What does success look like, and how can we measure that?

What is the type of buyer?

GitLab Ultimate

Links / references

A lot of the technical challenges with this issue are similar to those solved in #36871 (closed) - consider how that issue resolved them as part of working this issue.

This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.

Edited May 24, 2022 by 🤖 GitLab Bot 🤖
Assignee
Assign to
Time tracking