Skip to content

Commit 29e49f4

Browse files
aruunkumararuunkumar
committed
feat: add object storage capability, threats, and control
1 parent 8cb3d5e commit 29e49f4

3 files changed

Lines changed: 285 additions & 0 deletions

File tree

‎catalogs/storage/object/capabilities.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,3 +117,11 @@ capabilities:
117117
description: |
118118
Provides different storage classes for frequently and infrequently
119119
accessed objects.
120+
121+
- id: CCC.ObjStor.CP13
122+
group: Access
123+
title: Public Access Block
124+
description: |
125+
Supports configuring a default block on all public access to buckets
126+
and objects, preventing any policy or ACL from granting unauthenticated
127+
or anonymous access.

‎catalogs/storage/object/controls.yaml‎

Lines changed: 241 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -353,3 +353,244 @@ controls:
353353
- reference-id: IAM-08
354354
remarks: User Access Review
355355
strength: 2 # Reducing IAM nuance and exceptions helps streamline reviews
356+
357+
358+
- id: CCC.ObjStor.CN08
359+
group: Access
360+
title: Enforce Constraints on Pre-Signed URL Generation
361+
objective: |
362+
Ensure that pre-signed URLs are generated with minimum necessary
363+
permissions, limited expiry durations, and auditable generation
364+
events to prevent unauthorized access through leaked or overly
365+
permissive URLs.
366+
assessment-requirements:
367+
- id: CCC.ObjStor.CN08.AR01
368+
text: |
369+
When a pre-signed URL is generated, the service MUST enforce a
370+
maximum expiry duration that does not exceed an
371+
organization-defined threshold.
372+
applicability:
373+
- tlp-clear
374+
- tlp-green
375+
- tlp-amber
376+
- tlp-red
377+
recommendation: |
378+
Configure a maximum TTL policy for pre-signed URLs. For sensitive
379+
data, consider expiry durations of 15 minutes or less. Review and
380+
adjust thresholds based on operational requirements.
381+
- id: CCC.ObjStor.CN08.AR02
382+
text: |
383+
When a pre-signed URL is generated, the service MUST restrict
384+
the URL scope to a single object and a single operation (read or
385+
write), preventing broad access grants.
386+
applicability:
387+
- tlp-green
388+
- tlp-amber
389+
- tlp-red
390+
recommendation: |
391+
Ensure application logic generates URLs scoped to individual
392+
objects. Avoid wildcard or prefix-based URL generation that could
393+
expose multiple objects.
394+
- id: CCC.ObjStor.CN08.AR03
395+
text: |
396+
When a pre-signed URL is generated, the service MUST publish an
397+
auditable log entry that includes the generating identity, the
398+
target resource, the granted permissions, and the expiry time.
399+
applicability:
400+
- tlp-green
401+
- tlp-amber
402+
- tlp-red
403+
recommendation: |
404+
Enable logging for all pre-signed URL generation events. Integrate
405+
these logs with existing SIEM or monitoring systems for anomaly
406+
detection.
407+
- id: CCC.ObjStor.CN08.AR04
408+
text: |
409+
When a pre-signed URL is generated, the service MUST restrict
410+
generation to identities that have explicit permission to create
411+
pre-signed URLs, separate from their permission to access the
412+
underlying object.
413+
applicability:
414+
- tlp-amber
415+
- tlp-red
416+
recommendation: |
417+
Implement a dedicated IAM permission for pre-signed URL generation
418+
rather than implicitly granting this capability to all entities
419+
with object-level access.
420+
threats:
421+
- reference-id: CCC.ObjStor
422+
entries:
423+
- reference-id: CCC.ObjStor.TH02
424+
remarks: Pre-Signed URL Abuse
425+
strength: 9
426+
- reference-id: CCC
427+
entries:
428+
- reference-id: CCC.Core.TH01
429+
remarks: Access is Granted to Unauthorized Users
430+
strength: 4
431+
guidelines:
432+
- reference-id: CCM
433+
entries:
434+
- reference-id: IAM-01
435+
remarks: IAM Policy and Procedures
436+
strength: 5
437+
- reference-id: DSP-17
438+
remarks: Sensitive Data Protection
439+
strength: 3
440+
- reference-id: LOG-08
441+
remarks: Log Records
442+
strength: 5
443+
444+
- id: CCC.ObjStor.CN09
445+
group: Access
446+
title: Block Public Access by Default
447+
objective: |
448+
Ensure that all buckets and objects are protected from public
449+
(unauthenticated or anonymous) access by default, requiring explicit
450+
and auditable action to override.
451+
assessment-requirements:
452+
- id: CCC.ObjStor.CN09.AR01
453+
text: |
454+
When a bucket is created, the service MUST enable a public access
455+
block that prevents any policy or ACL from granting public access
456+
to the bucket or its objects.
457+
applicability:
458+
- tlp-clear
459+
- tlp-green
460+
- tlp-amber
461+
- tlp-red
462+
recommendation: |
463+
Enable account-level or organization-level public access block
464+
settings to ensure all new buckets inherit this protection by
465+
default.
466+
- id: CCC.ObjStor.CN09.AR02
467+
text: |
468+
When an attempt is made to modify a bucket policy or ACL to grant
469+
public access, the service MUST deny the modification unless the
470+
public access block has been explicitly disabled.
471+
applicability:
472+
- tlp-clear
473+
- tlp-green
474+
- tlp-amber
475+
- tlp-red
476+
recommendation: |
477+
Configure preventative controls at the organization level so that
478+
individual bucket owners cannot bypass the public access block
479+
without elevated approval.
480+
- id: CCC.ObjStor.CN09.AR03
481+
text: |
482+
When an attempt is made to disable the public access block, the
483+
service MUST require explicit approval from an identity with
484+
elevated privileges and MUST publish an auditable event to a
485+
monitored channel.
486+
applicability:
487+
- tlp-green
488+
- tlp-amber
489+
- tlp-red
490+
recommendation: |
491+
Implement an approval workflow or secondary authorization
492+
requirement for disabling public access blocks. Ensure all
493+
changes are logged and trigger alerts.
494+
- id: CCC.ObjStor.CN09.AR04
495+
text: |
496+
When the public access block is disabled, the service MUST NOT
497+
permit disabling for any bucket containing objects classified at
498+
TLP:AMBER or TLP:RED.
499+
applicability:
500+
- tlp-amber
501+
- tlp-red
502+
recommendation: |
503+
Use service control policies or organization-level guardrails to
504+
permanently enforce public access blocks on buckets containing
505+
sensitive data.
506+
threats:
507+
- reference-id: CCC
508+
entries:
509+
- reference-id: CCC.Core.TH01
510+
remarks: Access is Granted to Unauthorized Users
511+
strength: 9
512+
guidelines:
513+
- reference-id: CCM
514+
entries:
515+
- reference-id: DSP-07
516+
remarks: Data Protection by Design and Default
517+
strength: 9
518+
- reference-id: DSP-17
519+
remarks: Sensitive Data Protection
520+
strength: 7
521+
- reference-id: IAM-01
522+
remarks: IAM Policy and Procedures
523+
strength: 4
524+
525+
- id: CCC.ObjStor.CN10
526+
group: Data
527+
title: Restrict Storage Class Transitions to Approved Tiers
528+
objective: |
529+
Ensure that objects cannot be transitioned to storage classes with
530+
lower durability or availability guarantees without explicit
531+
authorization, preventing degradation of data resilience through
532+
misconfigured lifecycle policies or unauthorized actions.
533+
assessment-requirements:
534+
- id: CCC.ObjStor.CN10.AR01
535+
text: |
536+
When a lifecycle policy is configured to transition objects to a
537+
different storage class, the service MUST prevent transitions to
538+
any storage class not included in an organization-defined list of
539+
approved tiers.
540+
applicability:
541+
- tlp-green
542+
- tlp-amber
543+
- tlp-red
544+
recommendation: |
545+
Maintain a list of approved storage classes based on durability
546+
and availability requirements. Configure service-level policies
547+
to reject lifecycle rules targeting unapproved classes.
548+
- id: CCC.ObjStor.CN10.AR02
549+
text: |
550+
When a manual request is made to change an object's storage class
551+
to a tier with lower durability or availability, the service MUST
552+
require explicit approval from an identity with elevated
553+
privileges.
554+
applicability:
555+
- tlp-amber
556+
- tlp-red
557+
recommendation: |
558+
Implement IAM policies that separate storage class modification
559+
permissions from general object write permissions. Require
560+
secondary authorization for downgrades.
561+
- id: CCC.ObjStor.CN10.AR03
562+
text: |
563+
When a storage class transition occurs, the service MUST publish
564+
an auditable log entry including the identity that initiated the
565+
transition, the source and destination classes, and the affected
566+
objects.
567+
applicability:
568+
- tlp-green
569+
- tlp-amber
570+
- tlp-red
571+
recommendation: |
572+
Enable logging for all storage class transitions and integrate
573+
with monitoring systems to detect unexpected tier changes.
574+
threats:
575+
- reference-id: CCC.ObjStor
576+
entries:
577+
- reference-id: CCC.ObjStor.TH03
578+
remarks: Storage Class Downgrade Leading to Durability or Availability Loss
579+
strength: 9
580+
- reference-id: CCC
581+
entries:
582+
- reference-id: CCC.Core.TH06
583+
remarks: Data is Lost or Corrupted
584+
strength: 4
585+
guidelines:
586+
- reference-id: CCM
587+
entries:
588+
- reference-id: DSP-16
589+
remarks: Data Retention and Deletion
590+
strength: 6
591+
- reference-id: DSP-17
592+
remarks: Sensitive Data Protection
593+
strength: 4
594+
- reference-id: LOG-08
595+
remarks: Log Records
596+
strength: 5

‎catalogs/storage/object/threats.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,39 @@ threats:
4545
entries:
4646
- reference-id: CCC.ObjStor.CP08
4747
- reference-id: CCC.Core.CP11
48+
49+
- id: CCC.ObjStor.TH02
50+
group: Access
51+
title: Pre-Signed URL Abuse
52+
description: |
53+
Pre-signed URLs generated with excessive permissions, overly long
54+
expiry durations, or insufficient scope constraints may be leaked or
55+
shared beyond their intended audience. Because the URL itself acts as
56+
a bearer credential, any entity in possession of the URL can access
57+
the referenced resource without further authentication, bypassing
58+
standard access controls.
59+
capabilities:
60+
- reference-id: CCC
61+
entries:
62+
- reference-id: CCC.Core.CP05
63+
remarks: Signed URLs
64+
- reference-id: CCC.Core.CP06
65+
remarks: Access Control
66+
67+
- id: CCC.ObjStor.TH03
68+
group: Data
69+
title: Storage Class Downgrade Leading to Durability or Availability Loss
70+
description: |
71+
An authorized entity or misconfigured lifecycle policy may transition
72+
objects from a high-durability or high-availability storage class to a
73+
lower-durability or single-zone class. This degradation manifests only when
74+
a subsequent failure occurs (e.g., availability zone outage). Objects
75+
may also be transitioned to archival tiers, rendering them effectively
76+
inaccessible for extended retrieval periods during incidents.
77+
capabilities:
78+
- reference-id: CCC
79+
entries:
80+
- reference-id: CCC.ObjStor.CP08
81+
remarks: Lifecycle Policies
82+
- reference-id: CCC.ObjStor.CP12
83+
remarks: Storage Classes

0 commit comments

Comments
 (0)