rspec/rules/S6281/cloudformation/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

By default, when not set, the ``++PublicAccessBlockConfiguration++`` is fully deactivated (nothing is blocked):

[source,yaml]
----
AWSTemplateFormatVersion: 2010-09-09
Resources:
  S3Bucketdefault:
    Type: 'AWS::S3::Bucket' # Sensitive
    Properties:
      BucketName: "example"  
----

This ``++PublicAccessBlockConfiguration++`` allows public ACL to be set:

[source,yaml]
----
AWSTemplateFormatVersion: 2010-09-09
Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket' # Sensitive
    Properties:
      BucketName: "example"  
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false # should be true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
----

== Compliant Solution

This ``++PublicAccessBlockConfiguration++`` blocks public ACLs and policies, ignores existing public ACLs and restricts existing public policies:

[source,yaml]
----
AWSTemplateFormatVersion: 2010-09-09
Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket' # Compliant
    Properties:
      BucketName: "example" 
      PublicAccessBlockConfiguration: 
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

* Primary locations
** Make sure allowing public ACL/policies to be set is safe here.
** Omitting "PublicAccessBlockConfiguration" allows public ACL/policies to be set on this S3 bucket. Make sure it is safe here.
* Secondary location
** Set this property to true


=== Highlighting

* Primary locations
** PublicAccessBlockConfiguration property
** AWS::S3::Bucket resource
* Secondary location
** BlockPublicAcls / BlockPublicPolicy / IgnorePublicAcls / RestrictPublicBuckets properties set to false


endif::env-github,rspecator-view[]