Update s3_bucket.tf

[lcastrose]

No description provided.

[bridgecrew]

Bridgecrew has found 8 infrastructure configuration errors in this PR ⬇️

[bridgecrew]

  S3 bucket cross-region replication disabled
    Resource: aws_s3_bucket.foo | ID: BC_AWS_GENERAL_72

How to Fix

resource "aws_s3_bucket" "test" {
  ...
+  replication_configuration {
+    role = aws_iam_role.replication.arn
+    rules {
+      id     = "foobar"
+      prefix = "foo"
+      status = "Enabled"
+
+      destination {
+        bucket        = aws_s3_bucket.destination.arn
+        storage_class = "STANDARD"
+      }
+    }
+  }
}

Description

Cross-region replication enables automatic, asynchronous copying of objects across S3 buckets. By default, replication supports copying new S3 objects after it is enabled. It is also possible to use replication to copy existing objects and clone them to a different bucket, but in order to do so, you must contact AWS Support.

[bridgecrew]

  S3 Bucket does not have public access blocks
    Resource: aws_s3_bucket.foo | ID: BC_AWS_NETWORKING_52

How to Fix

resource "aws_s3_bucket" "bucket_good_1" {
  bucket = "bucket_good"
}

resource "aws_s3_bucket_public_access_block" "access_good_1" {
  bucket = aws_s3_bucket.bucket_good_1.id

  block_public_acls   = true
  block_public_policy = true
}

Description

When you create an S3 bucket, it is good practice to set the additional resource **aws_s3_bucket_public_access_block** to ensure the bucket is never accidentally public.

We recommend you ensure S3 bucket has public access blocks. If the public access block is not attached it defaults to False.

[bridgecrew]

  S3 buckets are not encrypted with KMS
    Resource: aws_s3_bucket.foo | ID: BC_AWS_GENERAL_56

How to Fix

resource "aws_s3_bucket" "mybucket" {
  ...
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.mykey.arn
 +      sse_algorithm     = "aws:kms"
      }
    }
  }
}

Description

TBA

[bridgecrew]

  AWS resources that support tags do not have Tags
    Resource: aws_s3_bucket.foo | ID: BC_AWS_GENERAL_26

How to Fix

resource "aws_security_group" "sg" {
  name = "my-sg"
  ...
+ tags = {
+   Environment = "dev"
+   Owner = "apps-team"
+ }
}

Description

Many different types of AWS resources support tags. Tags allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that tags can be used, we recommend you follow a tagging practice.

View AWS's recommended tagging best practices here.

[bridgecrew]

  Bucket ACL grants READ permission to everyone
    Resource: aws_s3_bucket.foo | ID: BC_AWS_S3_1

How to Fix

resource "aws_s3_bucket" "data" {
	...
  bucket        = "${local.resource_prefix.value}-data"
  acl           = "public-read"
}

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **READ** access to everyone can provide attackers the ability to read object data within the bucket, which can lead to the exposure of sensitive data. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for READ actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

• NIST-800-53 AC-17

[bridgecrew]

  AWS access logging not enabled on S3 buckets
    Resource: aws_s3_bucket.foo | ID: BC_AWS_S3_13

How to Fix

resource "aws_s3_bucket" "bucket" {
  acl    = var.s3_bucket_acl
  bucket = var.s3_bucket_name
  policy = var.s3_bucket_policy

  force_destroy = var.s3_bucket_force_destroy
  versioning {
    enabled    = var.versioning
    mfa_delete = var.mfa_delete
  }

+  dynamic "logging" {
+    for_each = var.logging
+    content {
+      target_bucket = logging.value["target_bucket"]
+      target_prefix = "log/${var.s3_bucket_name}"
+    }
+  }
}

Description

Access logging provides detailed audit logging for all objects and folders in an S3 bucket.

Benchmarks

• HIPAA 164.312(B) Audit controls

[bridgecrew]

  AWS S3 bucket is publicly writable
    Resource: aws_s3_bucket.foo | ID: BC_AWS_S3_2

How to Fix

Type: AWS::S3::Bucket
    Properties:
    	...
-     AccessControl: PublicReadWrite

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **WRITE** access to everyone allows attackers to create, overwrite and delete objects within the bucket, which can lead to: S3 data loss, unintended changes to applications using that bucket, and unexpected charges. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for WRITE actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

• NIST-800-53 AC-17

[bridgecrew]

Suggested change

	resource "aws_s3_bucket" "foo" {
	resource "aws_s3_bucket" "foo" {
	server_side_encryption_configuration {
	rule {
	apply_server_side_encryption_by_default {
	sse_algorithm = "AES256"
	}
	}
	}

  Data stored in the S3 bucket is not securely encrypted at rest
    Resource: aws_s3_bucket.foo | ID: BC_AWS_S3_14

Description

SSE helps prevent unauthorized access to S3 buckets. Encrypting and decrypting data at the S3 bucket level is transparent to users when accessing data.

Benchmarks

• PCI-DSS V3.2 3
• NIST-800-53 AC-17, SC-2
• PCI-DSS V3.2.1 3.4
• FEDRAMP (MODERATE) SC-28
• CIS AWS V1.3 2.1.1