0

Recently I received an email in order to tell me that some IE connections has access to my bucket:

eu-central-1|media.myapp | REST.GET.OBJECT|TLSv1|9|[Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NE
eu-central-1|media.myapp | REST.GET.OBJECT|TLSv1|54|[Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.1; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C;

But I want to know what are these devices and what IP use in order to diagnose the cause of the issue (legacy infrastructure no docs). Is there a way to keep an access log on what IAM accounts and devices under which IP and MAC receive items from my bucket?

Improve this question

2 Answers 2

Reset to default
0

I'm not sure if I understand your question properly, but if you're asking how to allow only certain users or IP's to access your S3 bucket (and I'm assuming you're talking about from the Public Internet), here is a block of a bucket policy that I have used to allow, for example, only public IP addresses that I want to access the bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<bucket name>/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "<first IP/32",
                        "<second IP>/32",
                        "<third IP>/32",
                        "<fourth IP>/32"
                    ]
                }
            }
        }
    ]
}

Hopefully, that can at least point you in the right direction.

Improve this answer
1
  • Strictly speaking, this policy does not actually allow only these IPs. It allows anonymous GetObject from these IPs, but it does not restrict any other IPs that might be allowed for other reasons. Any authenticated request would still be allowed from any other IP, and objects with public ACLs would also still be accessible from any IP if the bucket has object ACLs enabled.
    – Michael - sqlbot
    Apr 26 at 16:15
0

The Amazon S3 User Guide explains request logging.

Server access logging provides detailed records for the requests that are made to a bucket. Server access logs are useful for many applications. For example, access log information can be useful in security and access audits.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html

You will not be able to learn MAC addresses, since these are never transmitted over the Internet, but the device IP address (or public NAT address if the device is behind a NAT router) will be captured. To identify specific devices on the LAN behind a NAT router requires access to the devices and/or to the router.

The logs will also capture the IAM credentials used, if any, to access the object, will be captured in the logs.

There is nothing further that can be learned about the devices from the AWS side, beyond what is found in these logs.

Presumably, the email you are referring to is related to the fact that these devices are using TLSv1, which AWS is discontinuing support for, soon.

To respond to evolving technology and regulatory standards for Transport Layer Security (TLS), we will be updating the TLS configuration for all AWS service API endpoints to a minimum of version TLS 1.2. This update means you will no longer be able to use TLS versions 1.0 and 1.1 with all AWS APIs in all AWS Regions by June 28, 2023.

https://aws.amazon.com/blogs/security/tls-1-2-required-for-aws-endpoints/

You can block old versions of TLS now, before the API changes take effect, with an appropriate deny policy. This would potentially help you identify the devices from trouble reports. By periodically adding and removing the policy for now, you might be able to identify the devices without causing a permanent outage like will happen when the API changes are pushed out by AWS. Denied requests will still be logged by S3, but will be met with HTTP 403 response and an error of AccessDenied.

Improve this answer
2
  • The pproblem is that I do NOT know these devices no one has a record that these do exist and what they do. (Hence I hafta find out)
    – Dimitrios Desyllas
    Apr 27 at 8:40
  • @DimitriosDesyllas everything you can possibly learn about these machines from S3 can be found in the S3 access logs, specifically the public IP address, user agent string, and AWS credentials, it any. Disabling their access by configuring the bucket policy to deny access based on their old TLS version is one way of figuring it out -- based on the problems or complaints that occur when those machines lose access to the bucket.
    – Michael - sqlbot
    Apr 28 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .