Skip to content

Commit 1a7e3e2

Browse files
authored
feat(config): S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED managed rule (#18890)
> Currently [ManagedRuleIdentifiers](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-config.ManagedRuleIdentifiers.html) doesn't support identifier for s3-bucket-level-public-access-prohibited managed rule (S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED). The documentation for this rule is [here](https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-level-public-access-prohibited.html) Copied from: #18888 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 2cdfaf4 commit 1a7e3e2

File tree

2 files changed

+27
-0
lines changed

2 files changed

+27
-0
lines changed

packages/@aws-cdk/aws-config/lib/rule.ts

+7
Original file line numberDiff line numberDiff line change
@@ -1136,6 +1136,13 @@ export class ManagedRuleIdentifiers {
11361136
* @see https://docs.aws.amazon.com/config/latest/developerguide/s3-account-level-public-access-blocks.html
11371137
*/
11381138
public static readonly S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS = 'S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS';
1139+
/**
1140+
* Checks if Amazon Simple Storage Service (Amazon S3) buckets are publicly accessible. This rule is
1141+
* NON_COMPLIANT if an Amazon S3 bucket is not listed in the excludedPublicBuckets parameter and bucket level
1142+
* settings are public.
1143+
* @see https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-level-public-access-prohibited.html
1144+
*/
1145+
public static readonly S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED = 'S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED';
11391146
/**
11401147
* Checks that the Amazon Simple Storage Service bucket policy does not allow
11411148
* blocked bucket-level and object-level actions on resources in the bucket

packages/@aws-cdk/aws-config/test/managed-rules.test.ts

+20
Original file line numberDiff line numberDiff line change
@@ -165,3 +165,23 @@ describe('ec2 instance', () => {
165165
});
166166
});
167167
});
168+
169+
describe('s3 bucket level', () => {
170+
test('public access prohibited', () => {
171+
// GIVEN
172+
const stack = new cdk.Stack();
173+
174+
// WHEN
175+
new config.ManagedRule(stack, 'S3BucketLevelPublicAccessProhibited', {
176+
identifier: config.ManagedRuleIdentifiers.S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED,
177+
});
178+
179+
// THEN
180+
Template.fromStack(stack).hasResourceProperties('AWS::Config::ConfigRule', {
181+
Source: {
182+
Owner: 'AWS',
183+
SourceIdentifier: config.ManagedRuleIdentifiers.S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED,
184+
},
185+
});
186+
});
187+
});

0 commit comments

Comments
 (0)