Project: KICS (Provisioning / Security & Compliance)
File: 2d16c3fb-35ba-4ec0-b4e4-06ee3cbd4045.md

title: BOM - AWS S3 Buckets hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2d16c3fb-35ba-4ec0-b4e4-06ee3cbd4045 Query name: BOM - AWS S3 Buckets Platform: Terraform Severity: <span style="color:#CCCCCC">Trace</span> Category: Bill Of Materials URL: A list of S3 resources found. Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive1" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } versioning { mfa_delete = true } } resource "awslblistener" "listener5" { loadbalancerarn = aws_lb.test3.arn port = 80 default_action { type = "redirect" redirect { port = "80" protocol = "HTTP" statuscode = "HTTP301" } } } resource "aws_lb" "test3" { name = "test123" loadbalancertype = "application" subnets = [awssubnet.subnet1.id, awssubnet.subnet2.id] internal = true } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="14" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "positive10" { bucket = "my-tf-test-bucket" } resource "awss3bucketserversideencryptionconfiguration" "example" { bucket = awss3bucket.positive10.bucket rule { applyserversideencryptionby_default { kmsmasterkeyid = awskms_key.mykey.arn sse_algorithm = "aws:kms" } } } resource "awss3bucketacl" "examplebucket_acl2" { bucket = awss3bucket.positive10.id acl = "private" } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive2" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } serversideencryption_configuration { rule { applyserversideencryptionby_default { kmsmasterkey_id = "some-key" sse_algorithm = "AES256" } } } versioning { mfa_delete = true } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive3" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } serversideencryption_configuration { rule { applyserversideencryptionby_default { sse_algorithm = "aws:kms" } } } versioning { mfa_delete = true } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive4" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } serversideencryption_configuration { rule { applyserversideencryptionby_default { sse_algorithm = "aws:kms" } } } versioning { mfa_delete = true } } resource "awss3bucketpublicaccess_block" "positive4" { bucket = awss3bucket.positive4.id blockpublicacls = true blockpublicpolicy = true } ``` </details> <details><summary>Positive test

6 - tf file</summary> ```tf hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive5" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } serversideencryption_configuration { rule { applyserversideencryptionby_default { sse_algorithm = "aws:kms" } } } versioning { mfa_delete = true } } resource "awss3bucketpublicaccess_block" "positive5" { bucket = awss3bucket.positive5.id blockpublicacls = true blockpublicpolicy = false } ``` </details> <details><summary>Positive test num. 7 - tf file</summary> ```tf hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive6" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } serversideencryption_configuration { rule { applyserversideencryptionby_default { sse_algorithm = "aws:kms" } } } versioning { mfa_delete = true } policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` </details> <details><summary>Positive test num. 8 - tf file</summary> ```tf hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive7" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } serversideencryption_configuration { rule { applyserversideencryptionby_default { sse_algorithm = "aws:kms" } } } versioning { mfa_delete = true } } resource "awss3bucket_policy" "positive7" { bucket = awss3bucket.positive7.id policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` </details> <details><summary>Positive test num. 9 - tf file</summary> ```tf hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive8" { bucket = "my-tf-test-bucket" acl = "public-read" tags = { Name = "My bucket" Environment = "Dev" } serversideencryption_configuration { rule { applyserversideencryptionby_default { sse_algorithm = "aws:kms" } } } versioning { mfa_delete = true } serversideencryption_configuration { rule { applyserversideencryptionby_default { kmsmasterkeyid = awskms_key.mykey.arn sse_algorithm = "aws:kms" } } } } resource "awss3bucket_policy" "positive8" { bucket = awss3bucket.positive8.id policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal" : { "AWS": [ "arn:aws:iam::123456789012:root", "arn:aws:iam::555555555555:root" ] }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` </details> <details><summary>Positive test num. 10 - tf file</summary> ```tf hl_lines="14" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "positive9" { bucket = "my-tf-test-bucket" } ``` </details> ```tf title="Negative test num. 1 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } serversideencryption_configuration { rule { applyserversideencryptionby_default { kmsmasterkeyid = awskms_key.mykey.arn sse_algorithm = "aws:kms" } } } } ```