Description

Identifies AWS S3 bucket policies that allow public or overly permissive access through IAM configurations. Public access to S3 buckets can lead to unauthorized data exposure if not properly restricted.

Detection Strategy

• Examines Terraform configuration files for AWS IAM policy resources

• Identifies policy resources including: aws_iam_group_policy, aws_iam_policy, aws_iam_role_policy, aws_iam_user_policy, and aws_iam_policy_document

• Analyzes policy statements to detect configurations that grant access to public/anonymous users

• Reports a vulnerability when a policy allows unrestricted access to bucket resources

Vulnerable code example

resource "aws_iam_role_policy" "vulnerable_policy" {
  name = "vulnerable_policy"
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [...

✅ Secure code example

resource "aws_iam_role_policy" "secure_policy" {
  name = "secure_policy"
  role = aws_iam_role.example_role.id  # Explicitly specify the role
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {...