aws s3 policy s3EnforceUserAcl update

[gaurav-gogia]

• Updated rego code where bucket and it's attached policy was checked
• Fixes Valid Terraform configuration fails with s3EnforceUserAcl #659
• Following is a terraform snippet with a positive and negative case

provider "aws" {
  region = "us-east-1"
}


resource "aws_s3_bucket" "no_policy" {
  bucket = "frontend-access-logs"
  acl    = "private"

  versioning {
    enabled = true
  }

  logging {
    target_bucket = "log-bucket"
    target_prefix = "AWSLogs/frontend-lb-access-logs/"
  }
}


resource "aws_s3_bucket" "yes_policy" {
  bucket = "frontend-access-logs"
  acl    = "private"

  versioning {
    enabled = true
  }

  logging {
    target_bucket = "log-bucket"
    target_prefix = "AWSLogs/frontend-lb-access-logs/"
  }
}

resource "aws_s3_bucket_policy" "frontend_lb_logs_policy" {
  bucket = aws_s3_bucket.yes_policy.id

  policy = jsonencode({
    Version = "2012-10-17"
    Id      = "MYBUCKETPOLICY"
    Statement = [
      {
        Sid       = "IPAllow"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          aws_s3_bucket.b.arn,
          "${aws_s3_bucket.b.arn}/*",
        ]
        Condition = {
          IpAddress = {
            "aws:SourceIp" = "8.8.8.8/32"
          }
        }
      },
    ]
  })
}

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[codecov]

Codecov Report

Merging #828 (81e1b2b) into master (0ed8ef7) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #828   +/-   ##
=======================================
  Coverage   74.99%   74.99%           
=======================================
  Files         113      113           
  Lines        3463     3463           
=======================================
  Hits         2597     2597           
  Misses        675      675           
  Partials      191      191           

[shreyas-phansalkar-189]

Looks good, approved it.