Benchmark: Resource Policy Public Access
This benchmark answers the following questions:
- What resources have resource policies that allow public access?
This benchmark defines public as a policy having at least one Allow
statement that grants one or more permission to the *
principal, e.g.,
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPublicAccess1", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::EXAMPLE-BUCKET/*" } ]}
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPublicAccess2", "Effect": "Allow", "Principal": "*", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::EXAMPLE-BUCKET/*" } ]}
When evaluating statements for public access, the following condition keys are checked:
aws:PrincipalAccount
aws:PrincipalArn
aws:PrincipalOrgID
aws:SourceAccount
aws:SourceArn
aws:SourceOwner
And the following condition operators are checked:
ArnLike
ArnEquals
StringEquals
StringEqualsIgnoreCase
StringLike
For each statement, if there are any condition keys with any of the condition operators present then the statement is not considered to be granting public access. An extra check is performed for the ArnLike
and StringLike
operators to ensure that the condition key values do not contain *
.
The inverse condition operators, like StringNotEquals
and ArnNotLike
, are not currently evaluated.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-aws-perimeter
Start the Powerpipe server:
steampipe service startpowerpipe server
Open http://localhost:9033 in your browser and select Resource Policy Public Access.
Run this benchmark in your terminal:
powerpipe benchmark run aws_perimeter.benchmark.resource_policy_public_access
Snapshot and share results via Turbot Pipes:
powerpipe benchmark run aws_perimeter.benchmark.resource_policy_public_access --share
Controls
- API Gateway rest API policies should prohibit public access
- Backup vault policies should prohibit public access
- CloudWatch log resource policies should prohibit public access
- CodeArtifact domain policies should prohibit public access
- CodeArtifact repository policies should prohibit public access
- ECR repository policies should prohibit public access
- EFS file system policies should prohibit public access
- ES domain policies should prohibit public access
- EventBridge bus policies should prohibit public access
- Glacier vault policies should prohibit public access
- IAM role trust policies should prohibit public access
- KMS key policies should prohibit public access
- Lambda function policies should prohibit public access
- Elemental MediaStore container policies should prohibit public access
- S3 bucket policies should prohibit public access
- Secrets Manager secret policies should prohibit public access
- SNS topic policies should prohibit public access
- SQS queue policies should prohibit public access