Remediate AWS CIS v3.0 and v4.0 with Flowpipe's interactive wizard →
Flowpipe Hub 
Hub
standard
turbot/aws_thrifty
Overview
94
Pipelines
31
Triggers
139
VariablesGitHub

Overview

S3 Buckets without a lifecycle policy will not move objects between storage layers or expire objects, causing them to remain in their initial tier perpetually, this is inefficient and can be costly.

This query trigger detects S3 buckets which do not have a lifecycle policy attached and then either sends a notification or attempts to perform a predefined corrective action.

Getting Started

By default, this trigger is disabled, however it can be configured by setting the below variables

  • s3_buckets_without_lifecycle_policy_trigger_enabled should be set to true as the default is false.
  • s3_buckets_without_lifecycle_policy_trigger_schedule should be set to your desired running schedule
  • s3_buckets_without_lifecycle_policy_default_action should be set to your desired action (i.e. "notify" for notifications or "apply_lifecycle_configuration" to apply the policy).
  • s3_buckets_without_lifecycle_policy_default_lifecycle_configuration should be set to your desired lifecycle configuration if s3_buckets_without_lifecycle_policy_default_action is set to "apply_lifecycle_configuration".

Then starting the server:

flowpipe server

or if you've set the variables in a .fpvars file:

flowpipe server --var-file=/path/to/your.fpvars

Query

select
  concat(name, ' [', account_id, ']') as title,
  name,
  region,
  sp_connection_name as conn
from
  aws_s3_bucket
where
  lifecycle_rules is null;

Schedule

15m

Tags

category = Cost
class = managed
plugin = aws
service = AWS/S3