Project: KICS (Provisioning / Security & Compliance)
File: bd0088a5-c133-4b20-b129-ec9968b16ef3.md

title: CloudTrail Log Files S3 Bucket is Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: bd0088a5-c133-4b20-b129-ec9968b16ef3 Query name: CloudTrail Log Files S3 Bucket is Publicly Accessible Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Observability URL: CloudTrail Log Files S3 Bucket should not be publicly accessible<br> ```tf title="Positive test num. 1 - tf file" hl_lines="25" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } data "awscalleridentity" "current" {} resource "aws_cloudtrail" "foobar" { name = "tf-trail-foobar" s3bucketname = awss3bucket.b.id s3keyprefix = "prefix" includeglobalservice_events = false } resource "awss3bucket" "b" { bucket = "my-tf-test-bucket" acl = "public-read" tags = { Name = "My bucket" Environment = "Dev" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="23" variable "awsaccesskey" {} variable "awssecretkey" {} variable "privatekeypath" {} variable "key_name" {} variable "region" { default = "us-west-2" } provider "aws" { accesskey = var.awsaccess_key secretkey = var.awssecret_key region = var.region } module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" versioning = { enabled = true } bucket = "my_bucket" acl = "public-read" } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="24" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" versioning = { enabled = true } bucket = "my_bucket" acl = "public-read" } resource "aws_cloudtrail" "foobar2" { name = "tf-trail-foobar" s3bucketname = awss3bucket.bb.id s3keyprefix = "prefix" includeglobalservice_events = false } resource "awss3bucket" "bb" { bucket = "my-tf-test-bucket" } resource "awss3bucketacl" "examplebucket_acl" { bucket = awss3bucket.bb.id acl = "public-read" } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } data "awscalleridentity" "current2" {} resource "aws_cloudtrail" "foobar2" { name = "tf-trail-foobar" s3bucketname = awss3bucket.b2.id s3keyprefix = "prefix" includeglobalservice_events = false } resource "awss3bucket" "b2" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } } ``` ```tf title="Negative test num. 2 - tf file" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "aws_cloudtrail" "foobar4" { name = "tf-trail-foobar" s3bucketname = awss3bucket.bbb.id s3keyprefix = "prefix" includeglobalservice_events = false } resource "awss3bucket" "bb" { bucket = "my-tf-test-bucket" } resource "awss3bucketacl" "examplebucket_acl2" { bucket = awss3bucket.bbb.id acl = "private" } ```