AWS S3 Bucket Action Restrictions

AnalysisType: policy
Filename: aws_s3_bucket_action_restrictions.py
PolicyID: "AWS.S3.Bucket.ActionRestrictions"
DisplayName: "AWS S3 Bucket Action Restrictions"
Enabled: true
ResourceTypes:
  - AWS.S3.Bucket
Tags:
  - AWS
  - Identity & Access Management
  - Impact:Data Destruction
Reports:
  PCI:
    - 10.5.1
    - 10.5.2
  MITRE ATT&CK:
    - TA0040:T1485
Severity: Medium
Description: >
  Ensures that the S3 bucket policy does not allow any action on the bucket, in accordance with the principal of least privilege.
Runbook: >
  https://docs.runpanther.io/alert-runbooks/built-in-policies/aws-s3-bucket-policy-restricts-allowed-actions
Reference: https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html
Tests:
  - Name: Bucket Restricts Action
    ExpectedResult: true
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:ListBucket","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }
  - Name: Bucket Does Not Restrict S3 Actions
    ExpectedResult: false
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:*"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }
  - Name: Bucket Restricts Action With Deny Statement
    ExpectedResult: true
    Resource:
      {
        "CreationDate": "2019-01-01T00:00:00Z",
        "EncryptionRules":
          [
            {
              "ApplyServerSideEncryptionByDefault":
                { "KMSMasterKeyID": null, "SSEAlgorithm": "AES256" },
            },
          ],
        "Grants": null,
        "LifecycleRules": null,
        "Location": "us-east-2",
        "LoggingPolicy": null,
        "MFADelete": null,
        "Name": "bucket-name",
        "Owner":
          {
            "DisplayName": "user.name",
            "ID": "11112223334445556667778899aaabbbcccdddeeee",
          },
        "Policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":["s3:*","s3:PutObject"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]},{"Effect":"Allow","Principal":"*","Action":["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::test-bucket/*","arn:aws:s3:::test-bucket"]}]}',
        "PublicAccessBlockConfiguration":
          {
            "BlockPublicAcls": false,
            "BlockPublicPolicy": false,
            "IgnorePublicAcls": false,
            "RestrictPublicBuckets": false,
          },
        "Versioning": null,
      }


# ------ paired body: aws_s3_bucket_action_restrictions.py ------

import json

from policyuniverse.expander_minimizer import minimize_statement_actions

BAD_ACTIONS = {
    "*",
    "s3:*",
}


def policy(resource):
    if resource["Policy"] is None:
        return True

    iam_policy = json.loads(resource["Policy"])
    for statement in iam_policy["Statement"]:
        # Only check statements granting access
        if statement["Effect"] != "Allow":
            continue

        minimized_actions = minimize_statement_actions(statement)
        if BAD_ACTIONS.intersection(minimized_actions):
            return False

    return True