Project: KICS (Provisioning / Security & Compliance)
File: 37fa8188-738b-42c8-bf82-6334ea567738.md

title: S3 Bucket Should Have Bucket Policy hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 37fa8188-738b-42c8-bf82-6334ea567738 Query name: S3 Bucket Should Have Bucket Policy Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Insecure Defaults URL: Checks if S3 Bucket has the same name as a Bucket Policy, if it has, S3 Bucket has a Bucket Policy associated<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="56 4 31" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: S3Bucket3: Type: 'AWS::S3::Bucket' DeletionPolicy: Retain Properties: BucketName: docexamplebucket1 SampleBucketPolicy5: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: Ref: docexamplebucketfail PolicyDocument: Statement: Action: 's3:GetObject' Effect: Allow Resource: 'Fn::Join': '' - 'arn:aws:s3:::' Ref: docexamplebucket1 /* Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' S3Bucket: Type: 'AWS::S3::Bucket' DeletionPolicy: Retain Properties: {} SampleBucketPolicy2: Type: AWS::S3::BucketPolicy Properties: Bucket: docexamplebucket2 PolicyDocument: Statement: Action: 's3:GetObject' Effect: Allow Resource: 'Fn::Join': '' - 'arn:aws:s3:::' Ref: docexamplebucket /* Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' S3Bucket7: Type: 'AWS::S3::Bucket' DeletionPolicy: Retain Properties: BucketName: docexamplebucket5 SampleBucketPolicy8: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref docexamplebucketfail2 PolicyDocument: Statement: Action: 's3:GetObject' Effect: Allow Resource: 'Fn::Join': '' - 'arn:aws:s3:::' Ref: docexamplebucket1 /* Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Positive test num. 2 - json file" hl_lines="88 42 130" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "SampleBucketPolicy8": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": "docexamplebucketfail2", "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "docexamplebucket1" }, "/*" ] ] }, "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } }, "S3Bucket3": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": "docexamplebucket1" } }, "SampleBucketPolicy5": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "docexamplebucketfail" }, "PolicyDocument": { "Statement": [ { "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } }, "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "docexamplebucket1" }, "/*" ] ] }, "Principal": "*" } ] } } }, "S3Bucket": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": {} }, "SampleBucketPolicy2": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": "docexamplebucket2", "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "docexamplebucket" }, "/*" ] ] }, "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } }, "S3Bucket7": { "DeletionPolicy": "Retain", "Properties": { "BucketName": "docexamplebucket5" }, "Type": "AWS::S3::Bucket" } } } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="4" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: MyS3Bucket2: Type: 'AWS::S3::Bucket' Properties: AccessControl: PublicRead MetricsConfigurations: Id: EntireBucket WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html RoutingRules: RoutingRuleCondition: HttpErrorCodeReturnedEquals: '404' KeyPrefixEquals: out1/ RedirectRule: HostName: ec2-11-22-333-44.compute-1.amazonaws.com ReplaceKeyPrefixWith: report-404/ ``` <details><summary>Positive test

4 - json file</summary> ```json hl_lines="5" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "MyS3Bucket2": { "Properties": { "AccessControl": "PublicRead", "MetricsConfigurations": [ { "Id": "EntireBucket" } ], "WebsiteConfiguration": { "ErrorDocument": "error.html", "IndexDocument": "index.html", "RoutingRules": [ { "RedirectRule": { "HostName": "ec2-11-22-333-44.compute-1.amazonaws.com", "ReplaceKeyPrefixWith": "report-404/" }, "RoutingRuleCondition": { "HttpErrorCodeReturnedEquals": "404", "KeyPrefixEquals": "out1/" } } ] } }, "Type": "AWS::S3::Bucket" } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: S3Bucket: Type: 'AWS::S3::Bucket' DeletionPolicy: Retain Properties: BucketName: docexamplebucket SampleBucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: docexamplebucket PolicyDocument: Statement: Action: 's3:GetObject' Effect: Allow Resource: 'Fn::Join': '' - 'arn:aws:s3:::' Ref: docexamplebucket /* Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' S3Bucket9: Type: 'AWS::S3::Bucket' DeletionPolicy: Retain Properties: BucketName: docexamplebucket SampleBucketPolicy10: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref docexamplebucket PolicyDocument: Statement: Action: 's3:GetObject' Effect: Allow Resource: 'Fn::Join': '' - 'arn:aws:s3:::' Ref: docexamplebucket /* Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "S3Bucket": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": "docexamplebucket" } }, "SampleBucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": "docexamplebucket", "PolicyDocument": { "Statement": [ { "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "docexamplebucket" }, "/*" ] ] }, "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } }, "Action": [ "s3:GetObject" ], "Effect": "Allow" } ] } } }, "S3Bucket9": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": "docexamplebucket" } }, "SampleBucketPolicy10": { "Type": "AWS::S3::BucketPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } }, "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "docexamplebucket" }, "/*" ] ] } } ] }, "Bucket": "docexamplebucket" } } } } ``` ```yaml title="Negative test num. 3 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: MyS3Bucket22: Type: 'AWS::S3::Bucket' Properties: AccessControl: PublicRead MetricsConfigurations: Id: EntireBucket WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html RoutingRules: RoutingRuleCondition: HttpErrorCodeReturnedEquals: '404' KeyPrefixEquals: out1/ RedirectRule: HostName: ec2-11-22-333-44.compute-1.amazonaws.com ReplaceKeyPrefixWith: report-404/ SampleBucketPolicy2: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref MyS3Bucket22 PolicyDocument: Statement: Action: 's3:GetObject' Effect: Allow Resource: 'Fn::Join': '' - 'arn:aws:s3:::' Ref: docexamplebucket /* Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "MyS3Bucket22": { "Properties": { "AccessControl": "PublicRead", "MetricsConfigurations": [ { "Id": "EntireBucket" } ], "WebsiteConfiguration": { "ErrorDocument": "error.html", "IndexDocument": "index.html", "RoutingRules": [ { "RedirectRule": { "HostName": "ec2-11-22-333-44.compute-1.amazonaws.com", "ReplaceKeyPrefixWith": "report-404/" }, "RoutingRuleCondition": { "HttpErrorCodeReturnedEquals": "404", "KeyPrefixEquals": "out1/" } } ] } }, "Type": "AWS::S3::Bucket" }, "SampleBucketPolicy2": { "Properties": { "Bucket": "MyS3Bucket22", "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject" ], "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } }, "Effect": "Allow", "Principal": "*", "Resource": { "Fn::Join": [ "", { "playbooks": [ "arn:aws:s3:::", { "Ref": "docexamplebucket" }, "/*" ] } ] } } ] } }, "Type": "AWS::S3::BucketPolicy" } } } ``` </details>