Bug | restrict public access in several S3 Buckets cross-org

[exequielrafaela]

What?

• ⚠️ Restrict public access in several S3 Buckets cross-org which are miss-configured
• ❗ Whenever possible the fix must be included in the instantiated modules, such as:
  • https://github.com/binbashar/terraform-aws-tfstate-backend
  • https://github.com/binbashar/terraform-aws-vpc-flowlogs

Why?

How?

Eg for shared/base-tf-backend

• Must add ignore_public_acls = true at resource module "terraform_backend"
• Must add aws_s3_bucket_public_access_block(This should be ideally added at the terraform-aws-tfstate-backend module level)

module "terraform_backend" {
  source = "github.com/binbashar/terraform-aws-tfstate-backend.git?ref=v1.0.15"

  #
  # Bucket Name
  #
  delimiter = "-"
  namespace = var.project
  stage     = var.environment
  name      = "terraform-backend"

  #
  # Security
  #
  acl                           = "private"
  block_public_acls             = true
  block_public_policy           = true
  restrict_public_buckets       = true
  enable_server_side_encryption = var.encrypt
  enforce_ssl_requests          = true
  ignore_public_acls            = true

  #
  # Replication
  #
  bucket_replication_enabled = true

  tags = local.tags

  providers = {
    aws.main_region      = aws.main_region
    aws.secondary_region = aws.secondary_region
  }
}

resource "aws_s3_bucket_public_access_block" "replica_s3" {
  provider                = aws.secondary_region
  bucket                  = "${var.project}-${var.environment}-terraform-backend-replica"
  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

[exequielrafaela]

aws_s3_bucket_public_access_block already added https://github.com/binbashar/terraform-aws-tfstate-backend/blob/f8dcfaed7cd4707995c1ae5cde51dcc2ef5b7bfc/main.tf#L55

Only pending to pass the corresponding values to the module

• block_public_acls = true
• ignore_public_acls = true
• block_public_policy = true
• restrict_public_buckets = true

[marianod92]

Issue fixed on PR: Issue/256 s3 public access restriction #421