From 1beb483be3742a8a088542e9902fbaadfda4edc5 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Wed, 22 Apr 2020 20:40:18 +0200 Subject: [PATCH] Fixed issue with govcloud on extra764 #536 --- checks/check_extra764 | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/checks/check_extra764 b/checks/check_extra764 index ede847c7..96cf9100 100644 --- a/checks/check_extra764 +++ b/checks/check_extra764 @@ -37,13 +37,12 @@ extra764(){ fi # https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/ - CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:$AWS_PARTITION:s3:::${bucket}"'.Statement[]|select((((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*")) and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "true")') + CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:${AWS_PARTITION}:s3:::${bucket}" '.Statement[]|select((((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*")) and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")') if [[ $CHECK_BUCKET_STP_POLICY_PRESENT ]]; then textPass "Bucket $bucket has S3 bucket policy to deny requests over insecure transport" else textFail "Bucket $bucket allows requests over insecure transport" fi - rm -fr $TEMP_STP_POLICY_FILE done