PLA-45823 - Updated remediation job to restrict unsecured HTTP reques…

…ts for S3 Bucket (#131)
vmware-samples · Dec 5, 2022 · f5d0266 · f5d0266
1 parent 52daae6
commit f5d0266
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/remediation_worker/jobs/aws_s3_bucket_policy_allow_https/aws_s3_bucket_policy_allow_https.py b/remediation_worker/jobs/aws_s3_bucket_policy_allow_https/aws_s3_bucket_policy_allow_https.py
@@ -103,7 +103,7 @@ def remediate(self, client, cloud_account_id, bucket_name):
                 "Sid": "Restrict Non-https Requests",
                 "Effect": "Deny",
                 "Principal": "*",
-                "Action": "s3:GetObject",
+                "Action": "s3:*",
                 "Resource": f"arn:aws:s3:::{bucket_name}/*",
                 "Condition": {"Bool": {"aws:SecureTransport": "false"}},
             }

diff --git a/test/unit/test_aws_s3_bucket_policy_allow_https.py b/test/unit/test_aws_s3_bucket_policy_allow_https.py
@@ -98,7 +98,7 @@ def test_remediate_success(self):
                     "Sid": "Restrict Non-https Requests",
                     "Effect": "Deny",
                     "Principal": "*",
-                    "Action": "s3:GetObject",
+                    "Action": "s3:*",
                     "Resource": "arn:aws:s3:::bucket_name/*",
                     "Condition": {"Bool": {"aws:SecureTransport": "false"}},
                 },