Project: KICS (Provisioning / Security & Compliance)
File: 1df37f4b-7197-45ce-83f8-9994d2fcf885.md

title: S3 Bucket Allows Get Action From All Principals hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1df37f4b-7197-45ce-83f8-9994d2fcf885 Query name: S3 Bucket Allows Get Action From All Principals Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: S3 Buckets must not allow Get Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Get, for all Principals.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="17 42" resource "awss3bucket" "positive1" { bucket = "mytftest_bucket" } resource "awss3bucket_policy" "positive2" { bucket = awss3bucket.b.id policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } resource "awss3bucket_policy" "positive3" { bucket = awss3bucket.b.id policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="23" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY serversideencryption_configuration { rule { applyserversideencryptionby_default { kmsmasterkeyid = awskms_key.mykey.arn sse_algorithm = "aws:kms" } } } } ``` ```tf title="Negative test num. 1 - tf file" resource "awss3bucket" "negative1" { bucket = "mytftest_bucket" } resource "awss3bucket_policy" "negative2" { bucket = awss3bucket.b.id policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Action": "s3:*", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` ```tf title="Negative test num. 2 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Action": "s3:*", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY serversideencryption_configuration { rule { applyserversideencryptionby_default { kmsmasterkeyid = awskms_key.mykey.arn sse_algorithm = "aws:kms" } } } } ```