S3 bucket with unsecured CORS rule

Este producto no es compatible con el sitio Datadog seleccionado. ().
Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Metadata

Id: ansible-aws-s3-bucket-with-unsecured-cors-rule

Provider: AWS

Platform: Ansible

Severity: Medium

Category: Insecure Configurations

Learn More

Description

S3 CORS rules must restrict allowed origins, methods, and headers to prevent unintended cross-origin access and data exfiltration. Overly permissive CORS (wildcard origins, all methods, or all headers) can allow arbitrary web pages to interact with or read bucket resources.

For Ansible resources community.aws.s3_cors and s3_cors, inspect each rules entry. allowed_origins should specify trusted origins (avoid "*" or unnecessarily broad lists). allowed_methods must not be ["*"] and should include only the HTTP verbs required by your application. allowed_headers must not be ["*"] and should be limited to the headers actually needed.

Rules with wildcard allowed_methods or allowed_headers, or with wildcard or overly broad origins are flagged. Prefer a single explicit origin or a narrowly-scoped set and the minimal set of methods and headers.

Secure example:

- name: Configure S3 CORS
  community.aws.s3_cors:
    name: my-bucket
    rules:
      - allowed_origins:
          - https://app.example.com
        allowed_methods:
          - GET
          - HEAD
        allowed_headers:
          - Authorization
          - Content-Type

Compliant Code Examples

- name: Create s3 bucket
  community.aws.s3_cors:
    name: mys3bucket3
    state: present
    rules:
      - allowed_origins:
          - http://www.example.com/
        allowed_methods:
          - GET
          - POST
        allowed_headers:
          - Authorization
        expose_headers:
          - x-amz-server-side-encryption
          - x-amz-request-id
        max_age_seconds: 30000

- name: Create s3 bucket1
  community.aws.s3_cors:
    name: mys3bucket4
    state: present
    rules:
      - allowed_origins:
          - http://www.example.com/
        allowed_methods:
          - GET
          - POST
        allowed_headers:
          - Authorization
        expose_headers:
          - x-amz-server-side-encryption
          - x-amz-request-id
        max_age_seconds: 30000

Non-Compliant Code Examples

- name: Create s3 bucket2
  community.aws.s3_cors:
    name: mys3bucket
    state: present
    rules:
      - allowed_origins:
          - http://www.example.com/
        allowed_methods:
          - GET
          - POST
          - PUT
          - DELETE
          - HEAD
        allowed_headers:
          - Authorization
        expose_headers:
          - x-amz-server-side-encryption
          - x-amz-request-id
        max_age_seconds: 30000

- name: Create s3 bucket4
  community.aws.s3_cors:
    name: mys3bucket2
    state: present
    rules:
      - allowed_origins:
          - http://www.example.com/
        allowed_methods:
          - GET
          - POST
          - PUT
          - DELETE
          - HEAD
        allowed_headers:
          - Authorization
        expose_headers:
          - x-amz-server-side-encryption
          - x-amz-request-id
        max_age_seconds: 30000