The permission policy of AllowS3OperationsOnElasticBeanstalkBuckets is too wide. Even if it is called like only allow to the Beanstalk buckets, it grants FULL S3 access to ALL buckets in the account.
This is a security hole and needs to be fixed.
Expected Behavior
Least possible permissions.
Steps to Reproduce
Deploy an environment and look at the IAM policies.
It even shows in the code that some security rules were skipped intentionally:
#bridgecrew:skip=BC_AWS_IAM_57:Skipping "Ensure IAM policies does not allow write access without constraint"
#bridgecrew:skip=BC_AWS_IAM_56:Skipping "Ensure IAM policies do not allow permissions management / resource exposure without constraint"
#bridgecrew:skip=BC_AWS_IAM_55:Skipping "Ensure IAM policies do not allow data exfiltration"
Describe the Bug
The permission policy of AllowS3OperationsOnElasticBeanstalkBuckets is too wide. Even if it is called like only allow to the Beanstalk buckets, it grants FULL S3 access to ALL buckets in the account.
This is a security hole and needs to be fixed.
Expected Behavior
Least possible permissions.
Steps to Reproduce
Deploy an environment and look at the IAM policies.
See https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/main/main.tf#L303
It even shows in the code that some security rules were skipped intentionally:
Screenshots
No response
Environment
No response
Additional Context
No response