S3 bucket policy allows list actions for all IAM principals and public users Affecting S3 service in AWS

Configure the aws_s3_bucket policy field or the aws_s3_bucket_policy with a valid action, effect, and condition.

If a bucket policy is defined in an aws_s3_bucket policy field, ensure the JSON document does NOT contain BOTH an invalid principal, an invalid action, and an invalid effect:

• Invalid principals:
  • "*"
  • "AWS": "*"
• Invalid actions:
  • "s3:List*"
  • "s3:ListJobs"
  • "s3:ListBucket"
  • "s3:ListBucketVersions"
  • "s3:ListMultipartUploadParts"
• Invalid effect:
  • Allow

If a bucket policy as defined as an aws_s3_bucket_policy, ensure the JSON document in the policy field does NOT contain BOTH an invalid principal, an invalid action, and an invalid effect, as listed above

Example configuration:

resource "aws_s3_bucket" "b" {
  bucket = "my-tf-test-bucket"
  # other required fields here
}
resource "aws_s3_bucket_policy" "b" {
  bucket = aws_s3_bucket.b.id
  policy = jsonencode({
    Version = "2012-10-17"
    Id      = "MYBUCKETPOLICY"
    Statement = [
      {
        Sid       = "IPAllow"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          aws_s3_bucket.b.arn,
          "${aws_s3_bucket.b.arn}/*",
        ]
        Condition = {
          NotIpAddress = {
            "aws:SourceIp" = "8.8.8.8/32"
          }
        }
      },
    ]
  })
  
  # other required fields here
}