AWS Connect instance using publicly accessible S3 bucket
This policy identifies the S3 bucket used by AWS Connect instances  for storing CHAT_TRANSCRIPTS, CALL_RECORDINGS, and SCREEN_RECORDINGS, which are publicly accessible.

The S3 bucket containing CHAT_TRANSCRIPTS, CALL_RECORDINGS, or SCREEN_RECORDINGS being publicly accessible is significant, as it exposes sensitive customer data and internal data to the public.

It is recommended to secure the identified S3 buckets by enforcing stricter access controls and eliminating public read permissions for the reported S3 bucket used for AWS Connect instances.
This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To update the publicly accessible setting of a bucket, perform the following actions:
1. Log in to the AWS Console
2. Navigate to the 'S3' service
3. Click on the S3 resource reported in the alert
4. Click on the 'Permissions' tab
5. If Access Control List is set to 'Public' follow the below steps
         a. Under 'Access Control List', Click on 'Everyone' and uncheck all items
         b. Under 'Access Control List', Click on 'Authenticated users group' and uncheck all items
         c. Click on Save changes
6. If 'Bucket Policy' is set to public follow the below steps
         a. Under 'Bucket Policy', Select 'Edit Bucket Policy' and consider defining what explicit 'Principal' should have the ability to GET/LIST objects in your S3 bucket. You may also want to limit the 'Principal' ability to perform specific GET/LIST functions, without the  wild card.
         b. If 'Bucket Policy' is not required delete the existing 'Bucket Policy'.
         c. Click on Save changes
Note: Ensure updating the 'Access Control List' or 'Bucket Policy' does not affect S3 bucket data access..

Query:
```config from cloud.resource where api.name = 'aws-connect-instance' AND json.rule = InstanceStatus equals "ACTIVE" and storageConfig[?any( resourceType is member of ('CHAT_TRANSCRIPTS','CALL_RECORDINGS','SCREEN_RECORDINGS') and storageConfigs[*] exists )] exists as X; config from cloud.resource where api.name='aws-s3api-get-bucket-acl' AND json.rule = "((((acl.grants[?(@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee=='AllUsers')] size > 0) and ((publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false) or (publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false))) or (policyStatus.isPublic is true and ((publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false) or (publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false))))" as Y; filter ' $.X.storageConfig[*].storageConfigs[*].S3Config.BucketName intersects $.Y.bucketName' ; show Y;```