RhinoSecurityLabs / cloudgoat

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
BSD 3-Clause "New" or "Revised" License
2.89k stars 598 forks source link

Update s3.tf #193

Closed j0eblow closed 1 year ago

j0eblow commented 1 year ago

Fixes #188

Buckets are set to private by default now since April 27th, 2023.

It looks like the aws_s3_bucket_acl resource is attempting to set the bucket's ACL to private, but this operation is being blocked because ACLs are not supported for the bucket.

ACLs are now considered legacy access control, with bucket policies and IAM policies being the recommended way to manage access to S3 buckets.

Simply removing the ACL resource solves the issue.