AWS S3 Bucket Principal Restrictions

AnalysisType: policy
Filename: aws_s3_bucket_principal_restrictions.py
PolicyID: "AWS.S3.Bucket.PrincipalRestrictions"
DisplayName: "AWS S3 Bucket Principal Restrictions"
Enabled: true
ResourceTypes:
  - AWS.S3.Bucket
Tags:
  - AWS
  - Identity & Access Management
  - Collection:Data From Cloud Storage Object
Reports:
  PCI:
    - 10.5.1
    - 10.5.2
  MITRE ATT&CK:
    - TA0009:T1530
Severity: High
Description: >
  This policy validates that S3 Bucket access policies do not allow all users (Principal:"*") for a given action on the bucket, in accordance with the principle of least privilege.
Runbook: >
  https://docs.runpanther.io/alert-runbooks/built-in-policies/aws-s3-bucket-policy-restricts-principal
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
Tests:
  - Name: Bucket Does Not Restrict Principal
    ExpectedResult: false
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }
  - Name: Bucket Does Restrict Principal
    ExpectedResult: true
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }
  - Name: Bucket Does Not Restrict Principal But Has Condition
    ExpectedResult: true
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2008-10-17","Statement":[{"Sid":"Access","Effect":"Allow","Principal":"*","Action":["s3:GetObject","s3:GetObjectAcl","s3:ListBucket"],"Resource":["arn:aws:s3:::example-bucket"],"Condition":{"StringEquals":{"aws:PrincipalOrgID":"111111"}}}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }


# ------ paired body: aws_s3_bucket_principal_restrictions.py ------

import json

from policyuniverse.policy import Policy

BAD_PRINCIPALS = {
    "*",
}


def policy(resource):
    if resource["Policy"] is None:
        return True

    iam_policy = Policy(json.loads(resource["Policy"]))

    for statement in iam_policy.statements:
        # Only apply to allow effects
        if statement.effect != "Allow":
            continue

        # Don't apply where there are strong conditions
        if statement.condition_entries:
            continue

        if BAD_PRINCIPALS.intersection(statement.principals):
            return False

    return True