Check Bucket PolicyDocument with a conditional

[saiprasanthrajavarapu]

Hello Team,

I am looking for guidance around rule for making sure bucket policy has secure transport false

template:

s3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref s3Bucket
      PolicyDocument: !If
        - UseBucketPolicyCondtion
        - !Ref AWSS3BucketPolicyPolicyDocument
        - Statement:
            - Sid: AllowSSLRequestsOnly
              Action:
                - 's3:*'
              Effect: Deny
              Resource:
                - !Sub "arn:aws:s3:::${s3Bucket}/*"
                - !Sub "arn:aws:s3:::${s3Bucket}"
              Principal: '*'
              Condition:
                Bool:
                  aws:SecureTransport: 'false'

existing rule

rule aws_s3_bucket_policy when %aws_s3_bucket_policy !empty {
    %aws_s3_bucket_policy{
        Properties{
           when PolicyDocument.Statement exists{
                some PolicyDocument.Statement[*].Condition.Bool.'aws:SecureTransport' == "false"
            }
        }
    }
}

Cfn-guard skips the rule for the above template because of If condition. Is there anyway it can validate the statement that is hardcoded even there is a If condition?

[akumar-99]

@saiprasanthrajavarapu I hope this helps.

let s3_bucketpolicies = Resources.*[
    Type == "AWS::S3::BucketPolicy"
]

rule aws_s3_bucket_policy when %s3_bucketpolicies !empty {
    %s3_bucketpolicies {
        Properties {
            when PolicyDocument is_list {
                PolicyDocument.* {
                    when Statement exists {
                        Statement.* {
                            Condition {
                                Bool {
                                    'aws:SecureTransport' == 'false'
                                }
                            }
                        }
                    }
                }
            } OR
            PolicyDocument {
                Statement.* {
                    Condition {
                        Bool {
                            'aws:SecureTransport' == 'false'
                        }
                    }
                }
            }
        }
    }
}

[joshfried-aws]

Hi @saiprasanthrajavarapu since the above comment seems to have provided you with a sufficient answer.

Thanks,