aws-s3-private-bucket set ignore_public_acls and restrict_public_buckets #124
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ryanking
approved these changes
Sep 17, 2019
alldoami
approved these changes
Sep 17, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR strengthens the
aws-s3-private-bucketmodule by setting 2 more flagsignore_public_aclsandrestrict_public_bucketsthat tell S3 to ignore existing policies that can make a bucket more public than intended.The 2 previously set flags of
block_public_aclsandblock_public_policyonly prevent setting policies that could open up the bucket, but do not touch or affect the behavior of existing policies that make files/buckets public or available cross-account. This PR tells S3 to ignore the existing policies and block access even when nominally allowed by the existing policies.I intentionally have not made these overridable for now; if there are use cases where overriding this is desired, we can add that now or in a later PR.
See https://www.terraform.io/docs/providers/aws/r/s3_bucket_public_access_block.html#argument-reference for more details.