feat: add bucket_policy resource and mfa_delete Argument

[mamrajyadav]

what

• added aws_s3_bucket_policy resource and mfa_delete Argument.

[clouddrove-ci]

Terraform Security Scan Failed

Show Output

Result #1 HIGH Bucket does not have encryption enabled 
────────────────────────────────────────────────────────────────────────────────
  main.tf:17-26
────────────────────────────────────────────────────────────────────────────────
   17    resource "aws_s3_bucket" "s3_default" {
   18      count = var.enabled == true ? 1 : 0
   19    
   20      bucket              = var.s3_name != null ? var.s3_name : module.labels.id
   21      bucket_prefix       = var.bucket_prefix
   22      force_destroy       = var.force_destroy
   23      object_lock_enabled = var.object_lock_enabled
   24      tags                = module.labels.tags
   25    
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-encryption
      Impact The bucket objects could be read if compromised
  Resolution Configure bucket encryption

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-encryption/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption
────────────────────────────────────────────────────────────────────────────────


Result #2 HIGH Bucket does not encrypt data with a customer managed key. 
────────────────────────────────────────────────────────────────────────────────
  main.tf:17-26
────────────────────────────────────────────────────────────────────────────────
   17    resource "aws_s3_bucket" "s3_default" {
   18      count = var.enabled == true ? 1 : 0
   19    
   20      bucket              = var.s3_name != null ? var.s3_name : module.labels.id
   21      bucket_prefix       = var.bucket_prefix
   22      force_destroy       = var.force_destroy
   23      object_lock_enabled = var.object_lock_enabled
   24      tags                = module.labels.tags
   25    
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-encryption-customer-key
      Impact Using AWS managed keys does not allow for fine grained control
  Resolution Enable encryption using customer managed keys

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/encryption-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption
────────────────────────────────────────────────────────────────────────────────


Result #3 HIGH Public access block does not block public ACLs 
────────────────────────────────────────────────────────────────────────────────
  main.tf:569
────────────────────────────────────────────────────────────────────────────────
  564    resource "aws_s3_bucket_public_access_block" "this" {
  565      count = var.enabled && var.attach_public_policy ? 1 : 0
  566    
  567      bucket = local.attach_policy ? aws_s3_bucket_policy.s3_default[0].id : aws_s3_bucket.s3_default[0].id
  568    
  569  [   block_public_acls       = var.block_public_acls (false)
  570      block_public_policy     = var.block_public_policy
  571      ignore_public_acls      = var.ignore_public_acls
  572      restrict_public_buckets = var.restrict_public_buckets
  573    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-block-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable blocking any PUT calls with a public ACL specified

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/block-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #4 HIGH Public access block does not block public policies 
────────────────────────────────────────────────────────────────────────────────
  main.tf:570
────────────────────────────────────────────────────────────────────────────────
  564    resource "aws_s3_bucket_public_access_block" "this" {
  565      count = var.enabled && var.attach_public_policy ? 1 : 0
  566    
  567      bucket = local.attach_policy ? aws_s3_bucket_policy.s3_default[0].id : aws_s3_bucket.s3_default[0].id
  568    
  569      block_public_acls       = var.block_public_acls
  570  [   block_public_policy     = var.block_public_policy (false)
  571      ignore_public_acls      = var.ignore_public_acls
  572      restrict_public_buckets = var.restrict_public_buckets
  573    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-block-public-policy
      Impact Users could put a policy that allows public access
  Resolution Prevent policies that allow public access being PUT

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/block-public-policy/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_policy
────────────────────────────────────────────────────────────────────────────────


Result #5 HIGH Public access block does not ignore public ACLs 
────────────────────────────────────────────────────────────────────────────────
  main.tf:571
────────────────────────────────────────────────────────────────────────────────
  564    resource "aws_s3_bucket_public_access_block" "this" {
  565      count = var.enabled && var.attach_public_policy ? 1 : 0
  566    
  567      bucket = local.attach_policy ? aws_s3_bucket_policy.s3_default[0].id : aws_s3_bucket.s3_default[0].id
  568    
  569      block_public_acls       = var.block_public_acls
  570      block_public_policy     = var.block_public_policy
  571  [   ignore_public_acls      = var.ignore_public_acls (false)
  572      restrict_public_buckets = var.restrict_public_buckets
  573    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-ignore-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable ignoring the application of public ACLs in PUT calls

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/ignore-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #6 HIGH Public access block does not restrict public buckets 
────────────────────────────────────────────────────────────────────────────────
  main.tf:572
────────────────────────────────────────────────────────────────────────────────
  564    resource "aws_s3_bucket_public_access_block" "this" {
  565      count = var.enabled && var.attach_public_policy ? 1 : 0
  566    
  567      bucket = local.attach_policy ? aws_s3_bucket_policy.s3_default[0].id : aws_s3_bucket.s3_default[0].id
  568    
  569      block_public_acls       = var.block_public_acls
  570      block_public_policy     = var.block_public_policy
  571      ignore_public_acls      = var.ignore_public_acls
  572  [   restrict_public_buckets = var.restrict_public_buckets (false)
  573    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-no-public-buckets
      Impact Public buckets can be accessed by anyone
  Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/no-public-buckets/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡
────────────────────────────────────────────────────────────────────────────────


Result #7 MEDIUM Bucket does not have logging enabled 
────────────────────────────────────────────────────────────────────────────────
  main.tf:17-26
────────────────────────────────────────────────────────────────────────────────
   17    resource "aws_s3_bucket" "s3_default" {
   18      count = var.enabled == true ? 1 : 0
   19    
   20      bucket              = var.s3_name != null ? var.s3_name : module.labels.id
   21      bucket_prefix       = var.bucket_prefix
   22      force_destroy       = var.force_destroy
   23      object_lock_enabled = var.object_lock_enabled
   24      tags                = module.labels.tags
   25    
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-logging
      Impact There is no way to determine the access to this bucket
  Resolution Add a logging block to the resource to enable access logging

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-logging/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket
────────────────────────────────────────────────────────────────────────────────


Result #8 MEDIUM Bucket does not have versioning enabled 
────────────────────────────────────────────────────────────────────────────────
  main.tf:17-26
────────────────────────────────────────────────────────────────────────────────
   17    resource "aws_s3_bucket" "s3_default" {
   18      count = var.enabled == true ? 1 : 0
   19    
   20      bucket              = var.s3_name != null ? var.s3_name : module.labels.id
   21      bucket_prefix       = var.bucket_prefix
   22      force_destroy       = var.force_destroy
   23      object_lock_enabled = var.object_lock_enabled
   24      tags                = module.labels.tags
   25    
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-versioning
      Impact Deleted or modified data would not be recoverable
  Resolution Enable versioning to protect against accidental/malicious removal or modification

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-versioning/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             259.724µs
  parsing              309.020909ms
  adaptation           911.181µs
  checks               18.183525ms
  total                328.375339ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     86
  files read           4

  results
  ──────────────────────────────────────────
  passed               2
  ignored              0
  critical             0
  high                 6
  medium               2
  low                  0

  2 passed, 8 potential problem(s) detected.

[d4kverma]

LGTM

[13archit]

LGTM