Control: AWS S3 permissions granted to other AWS accounts in bucket policies should be restricted
Description
This control checks whether the S3 bucket policy prevents principals from other AWS accounts from performing denied actions on resources in the S3 bucket.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.s3_bucket_policy_restricts_cross_account_permission_changes
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.s3_bucket_policy_restricts_cross_account_permission_changes --share
SQL
This control uses a named query:
s3_bucket_policy_restricts_cross_account_permission_changes