Project: KICS (Provisioning / Security & Compliance)
File: 4bc4dd4c-7d8d-405e-a0fb-57fa4c31b4d9.md

title: S3 Bucket Policy Accepts HTTP Requests hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4bc4dd4c-7d8d-405e-a0fb-57fa4c31b4d9 Query name: S3 Bucket Policy Accepts HTTP Requests Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: S3 Bucket policy should not accept HTTP Requests<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8" resource "awss3bucket" "b" { bucket = "my-tf-test-bucket" } resource "awss3bucket_policy" "b" { bucket = awss3bucket.b.id policy = <<EOF { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "awss3bucket.b.arn" ], "Condition": { "IpAddress": { "aws:SourceIp": "8.8.8.8/32" } } } ] } EOF } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="4" resource "awss3bucket" "b2" { bucket = "my-tf-test-bucket" policy = <<EOF { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "awss3bucket.b.arn" ], "Condition": { "IpAddress": { "aws:SourceIp": "8.8.8.8/32" } } } ] } EOF } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="12" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } policy = <<EOF { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "awss3bucket.b.arn" ], "Condition": { "IpAddress": { "aws:SourceIp": "8.8.8.8/32" } } } ] } EOF } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="32" data "awsiampolicy_document" "pos4" { statement { effect = "Deny" principals { type = "*" identifiers = ["*"] } actions = [ "s3:*", ] resources = [ "arn:aws:s3:::a/*", "arn:aws:s3:::a", ] condition { test = "Bool" variable = "aws:SecureTransport" values = ["true"] } } } resource "awss3bucket" "pos4" { bucket = "a" policy = data.awsiampolicy_document.pos4.json } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="32" data "awsiampolicy_document" "pos5" { statement { effect = "Allow" principals { type = "*" identifiers = ["*"] } actions = [ "s3:*", ] resources = [ "arn:aws:s3:::a/*", "arn:aws:s3:::a", ] condition { test = "Bool" variable = "aws:SecureTransport" values = ["false"] } } } resource "awss3bucket" "pos5" { bucket = "a" policy = data.awsiampolicy_document.pos5.json } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awss3bucket" "b" { bucket = "my-tf-test-bucket" } resource "awss3bucket_policy" "b" { bucket = awss3bucket.b.id policy = <<EOF { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [

], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } EOF } ``` ```tf title="Negative test num. 2 - tf file" resource "awss3bucket" "b2" { bucket = "my-tf-test-bucket" policy = <<EOF { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "awss3bucket.b.arn" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } EOF } ``` ```tf title="Negative test num. 3 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } policy = <<EOF { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "awss3bucket.b.arn" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } }, { "Sid": "IPAllow", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "awss3bucket.c.arn" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } EOF } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } policy = <<EOF { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": "*", "Action": "s3:*", "Resource": [ "awss3bucket.b.arn" ], "Condition": { "Bool": { "aws:SecureTransport": "true" } } } ] } EOF } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf data "awsiampolicy_document" "neg5" { statement { effect = "Deny" principals { type = "*" identifiers = ["*"] } actions = [ "s3:*", ] resources = [ "arn:aws:s3:::a/*", "arn:aws:s3:::a", ] condition { test = "Bool" variable = "aws:SecureTransport" values = ["false"] } } } resource "awss3bucket" "neg5" { bucket = "a" policy = data.awsiampolicy_document.neg5.json } ``` </details> <details><summary>Negative test num. 6 - tf file</summary> ```tf data "awsiampolicy_document" "neg6" { statement { effect = "Allow" principals { type = "*" identifiers = ["*"] } actions = [ "s3:*", ] resources = [ "arn:aws:s3:::a/*", "arn:aws:s3:::a", ] condition { test = "Bool" variable = "aws:SecureTransport" values = ["true"] } } } resource "awss3bucket" "neg6" { bucket = "a" policy = data.awsiampolicy_document.neg6.json } ``` </details> <details><summary>Negative test num. 7 - tf file</summary> ```tf resource "awss3bucket" "negative7" { bucket = "my-tf-test-bucket" tags = { Name = "My bucket" Environment = "Dev" } } data "awsiampolicy_document" "policy" { statement { sid = "https" effect = "Deny" principals { type = "*" identifiers = ["*"] } actions = [ "s3:*" ] resources = [ awss3bucket.negative7.arn, "${awss3bucket.negative7.arn}/*" ] condition { test = "Bool" variable = "aws:SecureTransport" values = [ "false" ] } } } resource "awss3bucketpolicy" "bucketpolicy" { bucket = awss3bucket.negative7.id policy = data.awsiampolicy_document.policy.json } ``` </details>