Project: KICS (Provisioning / Security & Compliance)
File: 38c5ee0d-7f22-4260-ab72-5073048df100.md

title: S3 Bucket ACL Allows Read Or Write to All Users hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 38c5ee0d-7f22-4260-ab72-5073048df100 Query name: S3 Bucket ACL Allows Read Or Write to All Users Platform: Terraform Severity: <span style="color:#ff0000">Critical</span> Category: Access Control URL: S3 Buckets should not be readable and writable to all users<br> ```tf title="Positive test num. 1 - tf file" hl_lines="15" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive1" { bucket = "my-tf-test-bucket" acl = "public-read" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = true } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="16" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive2" { bucket = "my-tf-test-bucket" acl = "public-read-write" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = true } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="6" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "public-read" versioning = { enabled = true } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="6" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "public-read-write" versioning = { enabled = true } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="20" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } resource "awss3bucket" "example00" { bucket = "my-tf-example-bucket" } resource "awss3bucketacl" "examplebucket_acl" { bucket = awss3bucket.example00.id acl = "public-read" } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="20" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } resource "awss3bucket" "example000" { bucket = "my-tf-example-bucket" } resource "awss3bucketacl" "examplebucket_acl" { bucket = awss3bucket.example000.id acl = "public-read-write" } ``` </details> ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "negative1" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = true } } ``` ```tf title="Negative test num. 2 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } } ``` ```tf title="Negative test num. 3 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } resource "awss3bucket" "example0" { bucket = "my-tf-example-bucket" } resource "awss3bucketacl" "examplebucket_acl" { bucket = awss3bucket.example0.id acl = "private" } ```