Project: KICS (Provisioning / Security & Compliance)
File: bf878b1a-7418-4de3-b13c-3a86cf894920.md

title: S3 Bucket Public ACL Overridden By Public Access Block hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: bf878b1a-7418-4de3-b13c-3a86cf894920 Query name: S3 Bucket Public ACL Overridden By Public Access Block Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: S3 bucket public access is overridden by S3 bucket Public Access Block when the following attributes are set to true - 'blockpublicacls', 'blockpublicpolicy', 'ignorepublicacls', and 'restrictpublicbuckets'<br> ```tf title="Positive test num. 1 - tf file" hl_lines="16" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "public-bucket" { bucket = "bucket-with-public-acl-3" acl = "public-read-write" } resource "awss3bucketpublicaccessblock" "blockpublicbucket3" { bucket = awss3bucket.public-bucket.id blockpublicacls = true blockpublicpolicy = true ignorepublicacls = true restrictpublicbuckets = true } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="7" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "public-read-write" versioning = { enabled = true } blockpublicacls = true blockpublicpolicy = true ignorepublicacls = true restrictpublicbuckets = true } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="20" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "bu" { bucket = "my-tf-test-bucket" } resource "awss3bucketacl" "examplebucket_acl" { bucket = awss3bucket.bu.id acl = "public-read-write" } resource "awss3bucketpublicaccessblock" "blockpublicbucket3" { bucket = awss3bucket.bu.id blockpublicacls = true blockpublicpolicy = true ignorepublicacls = true restrictpublicbuckets = true } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "public-bucket2" { bucket = "bucket-with-public-acl-32" acl = "public-read-write" } resource "awss3bucketpublicaccessblock" "blockpublicbucket32" { bucket = awss3bucket.public-bucket2.id blockpublicacls = false blockpublicpolicy = true ignorepublicacls = false restrictpublicbuckets = true } ``` ```tf title="Negative test num. 2 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "public-read-write" versioning = { enabled = true } blockpublicacls = false blockpublicpolicy = true ignorepublicacls = false restrictpublicbuckets = true } ``` ```tf title="Negative test num. 3 - tf file" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "bu2" { bucket = "my-tf-test-bucket" } resource "awss3bucketacl" "examplebucket_acl2" { bucket = awss3bucket.bu2.id acl = "public-read-write" } resource "awss3bucketpublicaccessblock" "blockpublicbucket322" { bucket = awss3bucket.bu2.id blockpublicacls = false blockpublicpolicy = true ignorepublicacls = false restrictpublicbuckets = true } ```