Project: KICS (Provisioning / Security & Compliance)
File: 98a8f708-121b-455b-ae2f-da3fb59d17e1.md

title: S3 Bucket with Unsecured CORS Rule hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 98a8f708-121b-455b-ae2f-da3fb59d17e1 Query name: S3 Bucket with Unsecured CORS Rule Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: If the CORS (Cross-Origin Resource Sharing) rule is defined in an S3 bucket, it should be secure<br> ```tf title="Positive test num. 1 - tf file" hl_lines="27" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive1" { bucket = "my-tf-test-bucket" acl = "public-read" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = false } cors_rule { allowed_headers = ["*"] allowed_methods = ["PUT", "POST"] allowed_origins = ["https://s3-website-test.hashicorp.com"] expose_headers = ["ETag"] maxageseconds = 3000 } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="27" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive2" { bucket = "my-tf-test-bucket" acl = "public-read" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = false } cors_rule { allowed_headers = ["*"] allowed_methods = ["GET", "PUT", "POST", "DELETE", "HEAD"] allowed_origins = ["*"] expose_headers = ["ETag"] maxageseconds = 3000 } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="16" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" bucket = "s3-tf-example-versioning" acl = "private" version = "0.0.1" versioning = [ { enabled = true mfa_delete = null }, ] cors_rule = [ { allowed_headers = ["*"] allowed_methods = ["PUT", "POST"] allowed_origins = ["https://s3-website-test.hashicorp.com"] expose_headers = ["ETag"] maxageseconds = 3000 } ] } ``` <details><summary>Positive test

4 - tf file</summary> ```tf hl_lines="16" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" bucket = "s3-tf-example-versioning" acl = "private" version = "0.0.1" versioning = [ { enabled = true mfa_delete = null }, ] cors_rule = [ { allowed_headers = ["*"] allowed_methods = ["GET", "PUT", "POST", "DELETE", "HEAD"] allowed_origins = ["*"] expose_headers = ["ETag"] maxageseconds = 3000 } ] } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="26" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "bbb" { bucket = "my-tf-test-bucket" tags = { Name = "My bucket" Environment = "Dev" } } resource "awss3bucketcorsconfiguration" "example" { bucket = awss3bucket.bbb.bucket cors_rule { allowed_headers = ["*"] allowed_methods = ["GET", "PUT", "POST", "DELETE", "HEAD"] allowed_origins = ["*"] expose_headers = ["ETag"] maxageseconds = 3000 } } ``` </details> ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "negative1" { bucket = "s3-website-test.hashicorp.com" acl = "public-read" cors_rule { allowed_methods = ["PUT", "POST"] allowed_origins = ["https://s3-website-test.hashicorp.com"] expose_headers = ["ETag"] maxageseconds = 3000 } } ``` ```tf title="Negative test num. 2 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" bucket = "s3-tf-example-versioning" acl = "private" version = "0.0.1" versioning = [ { enabled = true mfa_delete = null }, ] cors_rule = [ { allowed_methods = ["PUT", "POST"] allowed_origins = ["https://s3-website-test.hashicorp.com"] expose_headers = ["ETag"] maxageseconds = 3000 } ] } ``` ```tf title="Negative test num. 3 - tf file" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "b" { bucket = "my-tf-test-bucket" tags = { Name = "My bucket" Environment = "Dev" } } resource "awss3bucketcorsconfiguration" "example" { bucket = awss3bucket.b.bucket cors_rule { allowed_methods = ["PUT", "POST"] allowed_origins = ["https://s3-website-test.hashicorp.com"] expose_headers = ["ETag"] maxageseconds = 3000 } } ```