AWS S3 bucket policy overly permissive to any principal misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_70
Category - Subcategory	Storage - Permissions
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	eecb0c21-2dbe-40f4-8727-fbbaacef69dc

Impact

This policy identifies the S3 buckets that have a bucket policy overly permissive to any principal and do not have Block public and cross-account access to buckets and objects through any public bucket or access point policies enabled. It is recommended to follow the principle of least privileges ensuring that the only restricted entities have permission on S3 operations instead of any anonymous. For more details: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-bucket-user-policy-specifying-principal-intro.html

How to Fix

[source,go]

resource "aws_s3_bucket" "bucket" { bucket = "bucket"

policy = <<POLICY { "Id": "Policy1597273448050", "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*",

• "Principal": "*" }, ...

---