Skip to main content

Configuration Summary

IDaws-s3-bucket
Provideraws
NameCCC AWS S3 Bucket Terraform Module
DescriptionThis module creates secure AWS S3 buckets with encryption, versioning, lifecycle management, and advanced security features.
Servicestorage
Pathremote/aws/s3bucket
GitHub LinkView GitHub Repository
Terraform FilesView Terraform Files

Repository Information

Repository Nameccc-cfi-compliance
DescriptionCCC CFI Compliance from FINOS Labs
Repository URLhttps://github.com/finos-labs/ccc-cfi-compliance
Downloaded AtOctober 7, 2025 at 07:54 AM
Workflow Status
successRun #18286885781

Test Summary

Aggregate summary of all tests in this configuration

Resources In Configuration12
Count of Tests42
Passing Tests20
Failing Tests22
Catalogs Tested

Test Mapping Summary

Summary of test mappings showing how event codes map to test requirements

Control CatalogTest Requirement IDMapped Tests (Event Code | Total | Passing | Failing)
CCC.ObjStorCCC.ObjStor.C01.TR01
kms_key_not_publicly_accessible
110
s3_bucket_kms_encryption
413
CCC.ObjStorCCC.ObjStor.C01.TR02
kms_cmk_not_deleted_unintentionally
514
kms_key_not_publicly_accessible
110
CCC.ObjStorCCC.ObjStor.C01.TR03
kms_cmk_not_deleted_unintentionally
514
kms_key_not_publicly_accessible
110
s3_bucket_kms_encryption
413
CCC.ObjStorCCC.ObjStor.C01.TR04
kms_cmk_not_deleted_unintentionally
514
kms_cmk_not_multi_region
110
kms_key_not_publicly_accessible
110
CCC.ObjStorCCC.ObjStor.C02.TR01
s3_bucket_public_write_acl
440
CCC.ObjStorCCC.ObjStor.C02.TR02
s3_bucket_acl_prohibited
422
s3_bucket_public_access
440
s3_bucket_public_write_acl
440
CCC.ObjStorCCC.ObjStor.C03.TR01
s3_bucket_lifecycle_enabled
413
s3_bucket_object_lock
413
s3_bucket_object_versioning
413
CCC.ObjStorCCC.ObjStor.C03.TR02
s3_bucket_lifecycle_enabled
413
s3_bucket_object_versioning
413
CCC.ObjStorCCC.ObjStor.C04.TR01
s3_bucket_object_lock
413
s3_bucket_object_versioning
413
CCC.ObjStorCCC.ObjStor.C05.TR01
s3_bucket_object_lock
413
s3_bucket_object_versioning
413
CCC.ObjStorCCC.ObjStor.C05.TR02
iam_rotate_access_key_90_days
220
s3_bucket_object_lock
413
s3_bucket_object_versioning
413
CCC.ObjStorCCC.ObjStor.C05.TR03
s3_bucket_object_versioning
413
CCC.ObjStorCCC.ObjStor.C05.TR04
kms_cmk_not_deleted_unintentionally
514
s3_bucket_object_versioning
413
CCC.ObjStorCCC.ObjStor.C06.TR01
cloudtrail_s3_dataevents_read_enabled
101
s3_bucket_server_access_logging_enabled
413

Resource Summary

Summary of all resources mentioned in OCSF results

Resource NameResource TypeControl CatalogsTotal TestsPassingFailing
<root_account>
AwsIamUser
No CCC catalogs
532
<root_account>
AwsIamAccessKey330
06e4e2ba-d746-4961-a0c3-8b3970228960
AwsKmsKey211
211203495394
AwsAccount
No CCC catalogs
511
211203495394
AwsBackupBackupVault
No CCC catalogs
101
211203495394
AwsCloudTrailTrail36036
211203495394
AwsCloudWatchAlarm
No CCC catalogs
15015
211203495394
Other
No CCC catalogs
30029
211203495394
AwsIamPolicy
No CCC catalogs
110
211203495394
AwsIamRole
No CCC catalogs
101
211203495394
AwsS3AccountPublicAccessBlock
No CCC catalogs
101
211203495394
AwsEc2Vpc
No CCC catalogs
101
3ebf1622-2c1f-4429-9607-9f07906793ad
AwsKmsKey211
AdministratorAccess
AwsIamPolicy
No CCC catalogs
101
analyzer/unknown
Other
No CCC catalogs
17017
AWSSupportServiceRolePolicy
AwsIamPolicy
No CCC catalogs
110
AWSTrustedAdvisorServiceRolePolicy
AwsIamPolicy
No CCC catalogs
110
b31b98c7-79dc-46c6-bee3-b32df95bca72
AwsKmsKey541
cloudfront-logs-joint-mutt
AwsS3Bucket17710
d1b7f965-bf16-4960-93e3-c6326c53f1f2
AwsKmsKey211
d2d3259d-bfff-4848-8bc7-d81169f2ed74
AwsKmsKey211
default
AwsEventsEventbus
No CCC catalogs
34340
logs-joint-mutt
AwsS3Bucket1789
model-invocation-logging
Other
No CCC catalogs
16016
s3-bucket-joint-mutt
AwsS3Bucket17134
SecurityAudit
AwsIamRole
No CCC catalogs
101
sg-008944225f228fd81
AwsEc2SecurityGroup
No CCC catalogs
220
sg-014e009f46ee13b45
AwsEc2SecurityGroup
No CCC catalogs
220
sg-01923ef90e2de7133
AwsEc2SecurityGroup
No CCC catalogs
220
sg-029960885501a0b75
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0327baf3109c76bd6
AwsEc2SecurityGroup
No CCC catalogs
220
sg-03318d6619212b0ba
AwsEc2SecurityGroup
No CCC catalogs
220
sg-03a7045e3785df7ff
AwsEc2SecurityGroup
No CCC catalogs
220
sg-066f794ff1205057d
AwsEc2SecurityGroup
No CCC catalogs
220
sg-099c221d7926804bb
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0b3de880562ea3eb7
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0c66948cc6f6dcdda
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0d76d3e4b114d9607
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0df0417b64dd9e39e
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0e59948ea67ec4573
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0e6674385e3c02b58
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0ec663ac32427bceb
AwsEc2SecurityGroup
No CCC catalogs
220
sg-0f7d37ac7dc72736c
AwsEc2SecurityGroup
No CCC catalogs
220
simple-joint-mutt
AwsS3Bucket1789
terraform-20251006160124533200000001
AwsIamRole
No CCC catalogs
101
terraform-user
AwsIamAccessKey220
terraform-user
AwsIamUser
No CCC catalogs
743
terraform-user/AdministratorAccess
AwsIamPolicy
No CCC catalogs
101
TerraformRole
AwsIamRole
No CCC catalogs
211
unknown
Other
No CCC catalogs
404
vpce-svc-028691921eaeee579
AwsEc2VpcEndpointService
No CCC catalogs
110
vpce-svc-02e288a4c6043110f
AwsEc2VpcEndpointService
No CCC catalogs
110

Test Results

OCSF test results filtered for entries with CCC compliance mappings

StatusFindingResource NameResource TypeMessageTest Requirements
FAIL
Check if S3 buckets have Object-level logging for read events is enabled in CloudTrail.
No CloudTrail trails have a data event to record all S3 object-level API operations.
211203495394
AwsCloudTrailTrail
No CloudTrail trails have a data event to record all S3 object-level API operations.
PASS
Ensure access keys are rotated every 90 days or less
User <root_account> does not have access keys.
<root_account>
AwsIamAccessKey
User <root_account> does not have access keys.
PASS
Ensure access keys are rotated every 90 days or less
User terraform-user does not have access keys older than 90 days.
terraform-user
AwsIamAccessKey
User terraform-user does not have access keys older than 90 days.
FAIL
AWS KMS keys should not be deleted unintentionally
KMS CMK 06e4e2ba-d746-4961-a0c3-8b3970228960 is scheduled for deletion, revert it if it was unintentionally.
06e4e2ba-d746-4961-a0c3-8b3970228960
AwsKmsKey
KMS CMK 06e4e2ba-d746-4961-a0c3-8b3970228960 is scheduled for deletion, revert it if it was unintentionally.
FAIL
AWS KMS keys should not be deleted unintentionally
KMS CMK 3ebf1622-2c1f-4429-9607-9f07906793ad is scheduled for deletion, revert it if it was unintentionally.
3ebf1622-2c1f-4429-9607-9f07906793ad
AwsKmsKey
KMS CMK 3ebf1622-2c1f-4429-9607-9f07906793ad is scheduled for deletion, revert it if it was unintentionally.
PASS
AWS KMS keys should not be deleted unintentionally
KMS CMK b31b98c7-79dc-46c6-bee3-b32df95bca72 is not scheduled for deletion.
b31b98c7-79dc-46c6-bee3-b32df95bca72
AwsKmsKey
KMS CMK b31b98c7-79dc-46c6-bee3-b32df95bca72 is not scheduled for deletion.
FAIL
AWS KMS keys should not be deleted unintentionally
KMS CMK d1b7f965-bf16-4960-93e3-c6326c53f1f2 is scheduled for deletion, revert it if it was unintentionally.
d1b7f965-bf16-4960-93e3-c6326c53f1f2
AwsKmsKey
KMS CMK d1b7f965-bf16-4960-93e3-c6326c53f1f2 is scheduled for deletion, revert it if it was unintentionally.
FAIL
AWS KMS keys should not be deleted unintentionally
KMS CMK d2d3259d-bfff-4848-8bc7-d81169f2ed74 is scheduled for deletion, revert it if it was unintentionally.
d2d3259d-bfff-4848-8bc7-d81169f2ed74
AwsKmsKey
KMS CMK d2d3259d-bfff-4848-8bc7-d81169f2ed74 is scheduled for deletion, revert it if it was unintentionally.
PASS
AWS KMS customer managed keys should not be multi-Region
KMS CMK b31b98c7-79dc-46c6-bee3-b32df95bca72 is a single-region key.
b31b98c7-79dc-46c6-bee3-b32df95bca72
AwsKmsKey
KMS CMK b31b98c7-79dc-46c6-bee3-b32df95bca72 is a single-region key.
PASS
Check exposed KMS keys
KMS key b31b98c7-79dc-46c6-bee3-b32df95bca72 is not exposed to Public.
b31b98c7-79dc-46c6-bee3-b32df95bca72
AwsKmsKey
KMS key b31b98c7-79dc-46c6-bee3-b32df95bca72 is not exposed to Public.
FAIL
Check if S3 buckets have ACLs enabled
S3 Bucket cloudfront-logs-joint-mutt has bucket ACLs enabled.
cloudfront-logs-joint-mutt
AwsS3Bucket
S3 Bucket cloudfront-logs-joint-mutt has bucket ACLs enabled.
PASS
Check if S3 buckets have ACLs enabled
S3 Bucket logs-joint-mutt has bucket ACLs disabled.
logs-joint-mutt
AwsS3Bucket
S3 Bucket logs-joint-mutt has bucket ACLs disabled.
FAIL
Check if S3 buckets have ACLs enabled
S3 Bucket s3-bucket-joint-mutt has bucket ACLs enabled.
s3-bucket-joint-mutt
AwsS3Bucket
S3 Bucket s3-bucket-joint-mutt has bucket ACLs enabled.
PASS
Check if S3 buckets have ACLs enabled
S3 Bucket simple-joint-mutt has bucket ACLs disabled.
simple-joint-mutt
AwsS3Bucket
S3 Bucket simple-joint-mutt has bucket ACLs disabled.
FAIL
Check if S3 buckets have KMS encryption enabled.
Server Side Encryption is not configured with kms for S3 Bucket cloudfront-logs-joint-mutt.
cloudfront-logs-joint-mutt
AwsS3Bucket
Server Side Encryption is not configured with kms for S3 Bucket cloudfront-logs-joint-mutt.
FAIL
Check if S3 buckets have KMS encryption enabled.
Server Side Encryption is not configured with kms for S3 Bucket logs-joint-mutt.
logs-joint-mutt
AwsS3Bucket
Server Side Encryption is not configured with kms for S3 Bucket logs-joint-mutt.
PASS
Check if S3 buckets have KMS encryption enabled.
S3 Bucket s3-bucket-joint-mutt has Server Side Encryption with aws:kms.
s3-bucket-joint-mutt
AwsS3Bucket
S3 Bucket s3-bucket-joint-mutt has Server Side Encryption with aws:kms.
FAIL
Check if S3 buckets have KMS encryption enabled.
Server Side Encryption is not configured with kms for S3 Bucket simple-joint-mutt.
simple-joint-mutt
AwsS3Bucket
Server Side Encryption is not configured with kms for S3 Bucket simple-joint-mutt.
FAIL
Check if S3 buckets have a Lifecycle configuration enabled
S3 Bucket cloudfront-logs-joint-mutt does not have a lifecycle configuration enabled.
cloudfront-logs-joint-mutt
AwsS3Bucket
S3 Bucket cloudfront-logs-joint-mutt does not have a lifecycle configuration enabled.
FAIL
Check if S3 buckets have a Lifecycle configuration enabled
S3 Bucket logs-joint-mutt does not have a lifecycle configuration enabled.
logs-joint-mutt
AwsS3Bucket
S3 Bucket logs-joint-mutt does not have a lifecycle configuration enabled.
PASS
Check if S3 buckets have a Lifecycle configuration enabled
S3 Bucket s3-bucket-joint-mutt has a lifecycle configuration enabled.
s3-bucket-joint-mutt
AwsS3Bucket
S3 Bucket s3-bucket-joint-mutt has a lifecycle configuration enabled.
FAIL
Check if S3 buckets have a Lifecycle configuration enabled
S3 Bucket simple-joint-mutt does not have a lifecycle configuration enabled.
simple-joint-mutt
AwsS3Bucket
S3 Bucket simple-joint-mutt does not have a lifecycle configuration enabled.
FAIL
Check if S3 buckets have object lock enabled
S3 Bucket cloudfront-logs-joint-mutt has Object Lock disabled.
cloudfront-logs-joint-mutt
AwsS3Bucket
S3 Bucket cloudfront-logs-joint-mutt has Object Lock disabled.
FAIL
Check if S3 buckets have object lock enabled
S3 Bucket logs-joint-mutt has Object Lock disabled.
logs-joint-mutt
AwsS3Bucket
S3 Bucket logs-joint-mutt has Object Lock disabled.
PASS
Check if S3 buckets have object lock enabled
S3 Bucket s3-bucket-joint-mutt has Object Lock enabled.
s3-bucket-joint-mutt
AwsS3Bucket
S3 Bucket s3-bucket-joint-mutt has Object Lock enabled.
FAIL
Check if S3 buckets have object lock enabled
S3 Bucket simple-joint-mutt has Object Lock disabled.
simple-joint-mutt
AwsS3Bucket
S3 Bucket simple-joint-mutt has Object Lock disabled.
FAIL
Check if S3 buckets have object versioning enabled
S3 Bucket cloudfront-logs-joint-mutt has versioning disabled.
cloudfront-logs-joint-mutt
AwsS3Bucket
S3 Bucket cloudfront-logs-joint-mutt has versioning disabled.
FAIL
Check if S3 buckets have object versioning enabled
S3 Bucket logs-joint-mutt has versioning disabled.
logs-joint-mutt
AwsS3Bucket
S3 Bucket logs-joint-mutt has versioning disabled.
PASS
Check if S3 buckets have object versioning enabled
S3 Bucket s3-bucket-joint-mutt has versioning enabled.
s3-bucket-joint-mutt
AwsS3Bucket
S3 Bucket s3-bucket-joint-mutt has versioning enabled.
FAIL
Check if S3 buckets have object versioning enabled
S3 Bucket simple-joint-mutt has versioning disabled.
simple-joint-mutt
AwsS3Bucket
S3 Bucket simple-joint-mutt has versioning disabled.
PASS
Ensure there are no S3 buckets open to Everyone or Any AWS user.
S3 Bucket cloudfront-logs-joint-mutt is not public.
cloudfront-logs-joint-mutt
AwsS3Bucket
S3 Bucket cloudfront-logs-joint-mutt is not public.
PASS
Ensure there are no S3 buckets open to Everyone or Any AWS user.
S3 Bucket logs-joint-mutt is not public.
logs-joint-mutt
AwsS3Bucket
S3 Bucket logs-joint-mutt is not public.
PASS
Ensure there are no S3 buckets open to Everyone or Any AWS user.
S3 Bucket s3-bucket-joint-mutt is not public.
s3-bucket-joint-mutt
AwsS3Bucket
S3 Bucket s3-bucket-joint-mutt is not public.
PASS
Ensure there are no S3 buckets open to Everyone or Any AWS user.
S3 Bucket simple-joint-mutt is not public.
simple-joint-mutt
AwsS3Bucket
S3 Bucket simple-joint-mutt is not public.
PASS
Ensure there are no S3 buckets writable by Everyone or Any AWS customer.
S3 Bucket cloudfront-logs-joint-mutt is not publicly writable.
cloudfront-logs-joint-mutt
AwsS3Bucket
S3 Bucket cloudfront-logs-joint-mutt is not publicly writable.
PASS
Ensure there are no S3 buckets writable by Everyone or Any AWS customer.
S3 Bucket logs-joint-mutt is not publicly writable.
logs-joint-mutt
AwsS3Bucket
S3 Bucket logs-joint-mutt is not publicly writable.
PASS
Ensure there are no S3 buckets writable by Everyone or Any AWS customer.
S3 Bucket s3-bucket-joint-mutt is not publicly writable.
s3-bucket-joint-mutt
AwsS3Bucket
S3 Bucket s3-bucket-joint-mutt is not publicly writable.
PASS
Ensure there are no S3 buckets writable by Everyone or Any AWS customer.
S3 Bucket simple-joint-mutt is not publicly writable.
simple-joint-mutt
AwsS3Bucket
S3 Bucket simple-joint-mutt is not publicly writable.
FAIL
Check if S3 buckets have server access logging enabled
S3 Bucket cloudfront-logs-joint-mutt has server access logging disabled.
cloudfront-logs-joint-mutt
AwsS3Bucket
S3 Bucket cloudfront-logs-joint-mutt has server access logging disabled.
FAIL
Check if S3 buckets have server access logging enabled
S3 Bucket logs-joint-mutt has server access logging disabled.
logs-joint-mutt
AwsS3Bucket
S3 Bucket logs-joint-mutt has server access logging disabled.
PASS
Check if S3 buckets have server access logging enabled
S3 Bucket s3-bucket-joint-mutt has server access logging enabled.
s3-bucket-joint-mutt
AwsS3Bucket
S3 Bucket s3-bucket-joint-mutt has server access logging enabled.
FAIL
Check if S3 buckets have server access logging enabled
S3 Bucket simple-joint-mutt has server access logging disabled.
simple-joint-mutt
AwsS3Bucket
S3 Bucket simple-joint-mutt has server access logging disabled.