S3 bucket with all permissions

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: cloudformation-aws-s3-bucket-with-all-permissions

Provider: AWS

Platform: CloudFormation

Severity: Critical

Category: Access Control

Learn More

Description

S3 bucket policies must not grant Allow for all actions to all principals. This creates public full access to the bucket and can result in data exposure, tampering, or deletion.

Check AWS::S3::BucketPolicy resources’ Properties.PolicyDocument.Statement entries and flag any statement where Effect: "Allow", Action: "*", and Principal: "*". Statements matching these conditions will be reported. Restrict principals to specific AWS account IDs/ARNs or services and limit Action to the minimum required S3 operations instead of using wildcards.

Secure example limiting access to a specific account and action:

MyBucketPolicy:
  Type: AWS::S3::BucketPolicy
  Properties:
    Bucket: !Ref MyBucket
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            AWS: arn:aws:iam::123456789012:root
          Action:
            - s3:GetObject
          Resource: !Sub '${MyBucket.Arn}/*'

Compliant Code Examples

#this code is a correct code for which the query should not find any result
Resources:
  SampleBucketPolicy1:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref DOC-EXAMPLE-BUCKET
      PolicyDocument:
        Statement:
          - Action:
              - 's3:GetObject'
            Effect: Deny
            Resource: '*'
            Principal: '*'
            Condition:
              StringLike:
                'aws:Referer':
                  - 'http://www.example.com/*'
                  - 'http://example.net/*'

Non-Compliant Code Examples

#this is a problematic code where the query should report a result(s)
Resources:
  SampleBucketPolicy3:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref DOC-EXAMPLE-BUCKET
      PolicyDocument:
        Statement:
          - Action: "*"
            Effect: Allow
            Resource: "*"
            Principal: "*"
            Condition:
              StringLike:
                'aws:Referer':
                  - 'http://www.example.com/*'
                  - 'http://example.net/*'