Adding non compliant full of holes s3 bucket #1
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| resource "aws_s3_bucket" "foo-bucket" { | ||
| region = var.region | ||
| bucket = local.bucket_name | ||
| force_destroy = true | ||
|
|
||
| tags = { | ||
| Name = "foo-${data.aws_caller_identity.current.account_id}" | ||
| } | ||
| versioning { | ||
| enabled = true | ||
| } | ||
| logging { | ||
| target_bucket = "${aws_s3_bucket.log_bucket.id}" | ||
| target_prefix = "log/" | ||
| } | ||
| server_side_encryption_configuration { | ||
| rule { | ||
| apply_server_side_encryption_by_default { | ||
| kms_master_key_id = "${aws_kms_key.mykey.arn}" | ||
| sse_algorithm = "aws:kms" | ||
| } | ||
| } | ||
| } | ||
| acl = "private" | ||
| } |
There was a problem hiding this comment.
tfsec check aws-s3-block-public-acls failed.
Description: No public access block so not blocking public acls
Severity: HIGH
For more information, see:
| resource "aws_s3_bucket" "foo-bucket" { | ||
| region = var.region | ||
| bucket = local.bucket_name | ||
| force_destroy = true | ||
|
|
||
| tags = { | ||
| Name = "foo-${data.aws_caller_identity.current.account_id}" | ||
| } | ||
| versioning { | ||
| enabled = true | ||
| } | ||
| logging { | ||
| target_bucket = "${aws_s3_bucket.log_bucket.id}" | ||
| target_prefix = "log/" | ||
| } | ||
| server_side_encryption_configuration { | ||
| rule { | ||
| apply_server_side_encryption_by_default { | ||
| kms_master_key_id = "${aws_kms_key.mykey.arn}" | ||
| sse_algorithm = "aws:kms" | ||
| } | ||
| } | ||
| } | ||
| acl = "private" | ||
| } |
There was a problem hiding this comment.
tfsec check aws-s3-block-public-policy failed.
Description: No public access block so not blocking public policies
Severity: HIGH
For more information, see:
| resource "aws_s3_bucket" "foo-bucket" { | ||
| region = var.region | ||
| bucket = local.bucket_name | ||
| force_destroy = true | ||
|
|
||
| tags = { | ||
| Name = "foo-${data.aws_caller_identity.current.account_id}" | ||
| } | ||
| versioning { | ||
| enabled = true | ||
| } | ||
| logging { | ||
| target_bucket = "${aws_s3_bucket.log_bucket.id}" | ||
| target_prefix = "log/" | ||
| } | ||
| server_side_encryption_configuration { | ||
| rule { | ||
| apply_server_side_encryption_by_default { | ||
| kms_master_key_id = "${aws_kms_key.mykey.arn}" | ||
| sse_algorithm = "aws:kms" | ||
| } | ||
| } | ||
| } | ||
| acl = "private" | ||
| } |
There was a problem hiding this comment.
tfsec check aws-s3-ignore-public-acls failed.
Description: No public access block so not ignoring public acls
Severity: HIGH
For more information, see:
| resource "aws_s3_bucket" "foo-bucket" { | ||
| region = var.region | ||
| bucket = local.bucket_name | ||
| force_destroy = true | ||
|
|
||
| tags = { | ||
| Name = "foo-${data.aws_caller_identity.current.account_id}" | ||
| } | ||
| versioning { | ||
| enabled = true | ||
| } | ||
| logging { | ||
| target_bucket = "${aws_s3_bucket.log_bucket.id}" | ||
| target_prefix = "log/" | ||
| } | ||
| server_side_encryption_configuration { | ||
| rule { | ||
| apply_server_side_encryption_by_default { | ||
| kms_master_key_id = "${aws_kms_key.mykey.arn}" | ||
| sse_algorithm = "aws:kms" | ||
| } | ||
| } | ||
| } | ||
| acl = "private" | ||
| } |
There was a problem hiding this comment.
tfsec check aws-s3-no-public-buckets failed.
Description: No public access block so not restricting public buckets
Severity: HIGH
For more information, see:
| resource "aws_s3_bucket" "foo-bucket" { | ||
| region = var.region | ||
| bucket = local.bucket_name | ||
| force_destroy = true | ||
|
|
||
| tags = { | ||
| Name = "foo-${data.aws_caller_identity.current.account_id}" | ||
| } | ||
| versioning { | ||
| enabled = true | ||
| } | ||
| logging { | ||
| target_bucket = "${aws_s3_bucket.log_bucket.id}" | ||
| target_prefix = "log/" | ||
| } | ||
| server_side_encryption_configuration { | ||
| rule { | ||
| apply_server_side_encryption_by_default { | ||
| kms_master_key_id = "${aws_kms_key.mykey.arn}" | ||
| sse_algorithm = "aws:kms" | ||
| } | ||
| } | ||
| } | ||
| acl = "private" | ||
| } |
There was a problem hiding this comment.
tfsec check aws-s3-specify-public-access-block failed.
Description: Bucket does not have a corresponding public access block.
Severity: LOW
For more information, see:
No description provided.