Project: KICS (Provisioning / Security & Compliance)
File: 7772bb8c-c0f3-42d4-8e4e-f1b8939ad085.md

title: S3 Bucket Access to Any Principal hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 7772bb8c-c0f3-42d4-8e4e-f1b8939ad085 Query name: S3 Bucket Access to Any Principal Platform: CloudFormation Severity: <span style="color:#ff0000">Critical</span> Category: Access Control URL: The S3 Bucket should not be associated with a policy statement that grants access to any principal<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2 27" Resources: Bucket: Type: AWS::S3::Bucket Properties: PublicAccessBlockConfiguration: BlockPublicAcls: false BlockPublicPolicy: false IgnorePublicAcls: true RestrictPublicBuckets: false BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref Bucket PolicyDocument: Statement: Effect: Allow Principal: AWS: "*" Action: s3:GetObject Resource: arn:aws:s3:::DOC-EXAMPLE-BUCKET/* Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' Bucket2: Type: AWS::S3::Bucket Properties: PublicAccessBlockConfiguration: BlockPublicAcls: false BlockPublicPolicy: false IgnorePublicAcls: false RestrictPublicBuckets: true BucketPolicy2: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref Bucket2 PolicyDocument: Statement: Effect: Allow Principal: AWS: "*" Action: s3:GetObject Resource: arn:aws:s3:::DOC-EXAMPLE-BUCKET/* Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Positive test num. 2 - json file" hl_lines="42 3" { "Resources": { "Bucket": { "Type": "AWS::S3::Bucket", "Properties": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": false, "BlockPublicPolicy": false, "IgnorePublicAcls": true, "RestrictPublicBuckets": false } } }, "BucketPolicy": { "Properties": { "PolicyDocument": { "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "*" ] }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] }, "Bucket": "Bucket" }, "Type": "AWS::S3::BucketPolicy" }, "Bucket2": { "Type": "AWS::S3::Bucket", "Properties": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": false, "BlockPublicPolicy": false, "IgnorePublicAcls": false, "RestrictPublicBuckets": true } } }, "BucketPolicy2": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": "Bucket2", "PolicyDocument": { "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "*" ] }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: Bucket: Type: AWS::S3::Bucket Properties: PublicAccessBlockConfiguration: BlockPublicAcls: false BlockPublicPolicy: false IgnorePublicAcls: true RestrictPublicBuckets: true BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref Bucket PolicyDocument: Statement: Effect: Allow Principal: AWS: arn:aws:iam::111122223333:user/Alice arn:aws:iam::111122223333:user/foo Action: s3:GetObject Resource: arn:aws:s3:::DOC-EXAMPLE-BUCKET/* Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Negative test num. 2 - json file" { "Resources": { "Bucket": { "Type": "AWS::S3::Bucket", "Properties": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": false, "BlockPublicPolicy": false, "IgnorePublicAcls": true, "RestrictPublicBuckets": true } } }, "BucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } }, "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::111122223333:user/Alice", "arn:aws:iam::111122223333:user/foo" ] }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*" } ] }, "Bucket": "Bucket" } } } } ```