including a check for verifying in line policy is mentioned or not, t…

…hus solves the false positive issue #359
tenable · Jan 9, 2021 · bbc6e5a · bbc6e5a
1 parent 5a19951
commit bbc6e5a
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/pkg/policies/opa/rego/aws/aws_s3_bucket/s3EnforceUserACL.rego b/pkg/policies/opa/rego/aws/aws_s3_bucket/s3EnforceUserACL.rego
@@ -3,6 +3,9 @@ package accurics
 {{.prefix}}s3EnforceUserACL[retVal] {
     bucket := input.aws_s3_bucket[_]
 
+    #proceeding forward only if inline policy is not included
+    not bucket.config.policy
+
     bucket_policies_set := { policy_id | policy_id := split(input.aws_s3_bucket_policy[_].id, "." )[1] }
 
     not bucket_policies_set[split(bucket.id, ".")[1]]