Description

Identifies AWS S3 bucket policies in CloudFormation templates that could allow unauthorized public access by using wildcard principals ('*'). Such configurations can expose S3 bucket contents to anyone on the internet, potentially leading to data breaches.

Detection Strategy

• Scans CloudFormation template files for S3 bucket policy resource definitions (AWS::S3::BucketPolicy type)

• Examines the Principal element in the bucket policy statements

• Reports a vulnerability if the Principal is set to '*' or contains overly permissive wildcards

• Flags only bucket policies that combine permissive principals with resource-level access

Vulnerable code example

Resources:
  UnsafeS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MyS3Bucket
      PolicyDocument:
        Statement:
          - Action:  # Vulnerable: Allows all S3 actions (*) to any principal...

✅ Secure code example

Resources:
  SafeS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MyS3Bucket
      PolicyDocument:
        Statement:
          - Action:  # Only grant specific required actions instead of s3:*...