S3 bucket policy allows lockout all but root user misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_93
Category - Subcategory	Storage - Permissions
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule is designed to prevent configuration policies that could potentially lock out non-root users from accessing S3 buckets. This check is vital for maintaining access control in AWS environments and ensuring that bucket policies do not inadvertently create security risks by overly restrictive configurations.

How to Fix

Resource: aws_s3_bucket, aws_s3_bucket_policy

• Argument: policy

Do not deny overly broad actions with a broad set of resources for all principals in an S3 policy. [source,go]

resource "aws_s3_bucket" "example" { bucket = "example" }

resource "aws_s3_bucket_policy" "example" { bucket = aws_s3_bucket.example.id

policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny",

• "Principal": "*",
• "Principal": { "AWS":"some_arn" }, "Action": "s3:*",
• "Resource": ["arn:aws:s3:::example/*", "arn:aws:s3:::example"] } ] } POLICY }

---