Control: S3 bucket ACLs should not be accessible to all authenticated user

powerpipe control run aws_compliance.control.s3_bucket_not_accessible_to_all_authenticated_user

powerpipe login
powerpipe control run aws_compliance.control.s3_bucket_not_accessible_to_all_authenticated_user --share

with public_acl as (
  select
    distinct name
  from
    aws_s3_bucket,
    jsonb_array_elements(acl -> 'Grants') as grants
  where
    grants -> 'Grantee' ->> 'URI' = 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
)
select
  b.arn as resource,
  case
    when p.name is null then 'ok'
    else 'alarm'
  end status,
  case
    when p.name is null then b.title || ' not accessible to all authenticated user.'
    else b.title || ' accessible to all authenticated user.'
  end as reason
  
  , b.region, b.account_id
from
  aws_s3_bucket as b
  left join public_acl as p on b.name = p.name;