turbot/aws_compliance

Control: AWS S3 permissions granted to other AWS accounts in bucket policies should be restricted

Description

This control checks whether the S3 bucket policy prevents principals from other AWS accounts from performing denied actions on resources in the S3 bucket.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.s3_bucket_policy_restricts_cross_account_permission_changes

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.s3_bucket_policy_restricts_cross_account_permission_changes --share

SQL

This control uses a named query:

s3_bucket_policy_restricts_cross_account_permission_changes

Tags