rules/aws-storage-s3-bucket-default-lock-enabled.yaml

# opnrvn-r-152
ruleId: aws-storage-s3-bucket-default-lock-enabled
type: asset
ruleName: >
  Checks whether Amazon S3 bucket has lock enabled, by default.
description: >
  The rule is NON_COMPLIANT if the lock is not enabled.
severity: high
enabled: true
sql: >
  SELECT arn
  from magpie.awss3bucket
  WHERE
  (supplementaryconfiguration->'bucketObjectLockConfiguration' = 'null'
  OR supplementaryconfiguration->'bucketObjectLockConfiguration'->>'objectLockEnabled' != 'Enabled');
remediationDocURLs: https://github.com/openraven/security-rules/wiki
version: 0.9