Skip to main content

🧠 AWS S3 Bucket Policy allows public read or write access - prod.logic.yaml🟢

Uses​

Test Results 🟢​

Generated at: 2025-11-20T13:28:59.335004485Z Open

ResultIdCondition IndexCondition TextRuntime Error
🟢test1✔️ 99✔️ isDisappeared(CA10__disappearanceTime__c)✔️ null
🟢test2✔️ 199✔️ extract('CA10__policyIsPublic__c') != 'Yes'✔️ null
🟢test3✔️ 299✔️ extract('CA10__blockPublicPolicy__c') == 'Yes'✔️ null
🟢test4✔️ 399✔️ CA10__policyDocumentExt__c .allows(EXTERNAL_PRINCIPAL, [s3:PutObject, s3:DeleteObject, s3:DeleteObjectVersion, ... 3 elements])✔️ null
🟢test5✔️ 399✔️ CA10__policyDocumentExt__c .allows(EXTERNAL_PRINCIPAL, [s3:PutObject, s3:DeleteObject, s3:DeleteObjectVersion, ... 3 elements])✔️ null
🟢test6✔️ 499✔️ CA10__policyDocumentExt__c .allows(EXTERNAL_PRINCIPAL, [s3:ListBucket, s3:GetObject, s3:GetObjectVersion])✔️ null
🟢test7✔️ 500✔️ otherwise✔️ null
🟢test8✔️ 399✔️ CA10__policyDocumentExt__c .allows(EXTERNAL_PRINCIPAL, [s3:PutObject, s3:DeleteObject, s3:DeleteObjectVersion, ... 3 elements])✔️ null

Generation Bundle​

FileMD5
Open/ce/ca/aws/s3/bucket-public-policy/policy.yamlB62FF81E400345859A590AA6997A1ABD
Open/ce/ca/aws/s3/bucket-public-policy/prod.logic.yamlBDEBE5D7D804919A894AB2E4D20DB9C2
Open/ce/ca/aws/s3/bucket-public-policy/test-data.jsonBB67B151D64F1FE0A0DC4B70CCC95169
Open/types/CA10__CaAwsBucket__c/object.extracts.yamlF56AFA293B0B19D4F39C1EBB70F4C56F

Available Commands​

repo-manager policies generate FULL /ce/ca/aws/s3/bucket-public-policy/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/s3/bucket-public-policy/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/s3/bucket-public-policy/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/s3/bucket-public-policy/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/s3/bucket-public-policy/prod.logic.yaml

Content​

Open File

---
inputType: "CA10__CaAwsBucket__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10__CaAwsBucket__c/object.extracts.yaml"
conditions:
  - status: "COMPLIANT"
    currentStateMessage: "The bucket policy is not public."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: CA10__policyIsPublic__c
        right:
          TEXT: "Yes"
  - status: "COMPLIANT"
    currentStateMessage: "The Bucket policy is public but the block public policy configuration is enabled."
    check:
      IS_EQUAL:
        left:
          EXTRACT: CA10__blockPublicPolicy__c
        right:
          TEXT: "Yes"
  - status: "INCOMPLIANT"
    currentStateMessage: "The bucket policy grants public write access to the bucket data."
    remediationMessage: "Consider removing the public write access from the bucket."
    check:
      AWS_POLICY_ALLOWS:
        widestAcceptableAccessLevel: "EXTERNAL_PRINCIPAL"
        policyExtField: "CA10__policyDocumentExt__c"
        actions:
          - "s3:PutObject"
          - "s3:DeleteObject"
          - "s3:DeleteObjectVersion"
          - "s3:PutObjectAcl"
          - "s3:PutBucketAcl"
          - "s3:PutBucketPolicy"
  - status: "INCOMPLIANT"
    currentStateMessage: "The bucket policy grants public read access to the bucket data."
    remediationMessage: "Consider removing the public read access from the bucket."
    check:
      AWS_POLICY_ALLOWS:
        widestAcceptableAccessLevel: "EXTERNAL_PRINCIPAL"
        policyExtField: "CA10__policyDocumentExt__c"
        actions:
          - "s3:ListBucket"
          - "s3:GetObject"
          - "s3:GetObjectVersion"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "The Bucket policy does not grant public read or write access to the bucket data."