SECURITY: AllowS3OperationsOnElasticBeanstalkBuckets permits s3:*

[nodomain]

Describe the Bug

The permission policy of AllowS3OperationsOnElasticBeanstalkBuckets is too wide. Even if it is called like only allow to the Beanstalk buckets, it grants FULL S3 access to ALL buckets in the account.

This is a security hole and needs to be fixed.

Expected Behavior

Least possible permissions.

Steps to Reproduce

Deploy an environment and look at the IAM policies.

See https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/main/main.tf#L303

It even shows in the code that some security rules were skipped intentionally:

#bridgecrew:skip=BC_AWS_IAM_57:Skipping "Ensure IAM policies does not allow write access without constraint" 
#bridgecrew:skip=BC_AWS_IAM_56:Skipping "Ensure IAM policies do not allow permissions management / resource exposure without constraint"
#bridgecrew:skip=BC_AWS_IAM_55:Skipping "Ensure IAM policies do not allow data exfiltration"

Screenshots

No response

Environment

No response

Additional Context

No response

[arnoldasbrazys]

+1

you might consider my take at it with limiting with more fine grained permissions for S3 bucket, *these are subject to change

statement {
    sid = "BeanstalkDeploymentS3"

    actions = [
      "s3:AbortMultipartUpload",
      "s3:BypassGovernanceRetention",
      "s3:CreateBucket",
      "s3:CreateBucketMetadataTableConfiguration",
      "s3:CreateStorageLensGroup",
      "s3:DeleteBucketMetadataTableConfiguration",
      "s3:DeleteJobTagging",
      "s3:DeleteObject",
      "s3:DeleteObjectTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteStorageLensConfigurationTagging",
      "s3:DeleteStorageLensGroup",
      "s3:GetBucketLocation",
      "s3:GetBucketMetadataTableConfiguration",
      "s3:GetBucketPolicy",
      "s3:GetBucketTagging",
      "s3:GetJobTagging",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectLegalHold",
      "s3:GetObjectRetention",
      "s3:GetObjectTagging",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionTorrent",
      "s3:GetStorageLensConfigurationTagging",
      "s3:GetStorageLensGroup",
      "s3:InitiateReplication",
      "s3:ListBucket",
      "s3:ListBucketVersions",
      "s3:ListCallerAccessGrants",
      "s3:ListMultipartUploadParts",
      "s3:ListStorageLensGroups",
      "s3:ListTagsForResource",
      "s3:ObjectOwnerOverrideToBucketOwner",
      "s3:PauseReplication",
      "s3:PutAccessPointPublicAccessBlock",
      "s3:PutBucketTagging",
      "s3:PutBucketPolicy",
      "s3:PutJobTagging",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectLegalHold",
      "s3:PutObjectRetention",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
      "s3:PutStorageLensConfigurationTagging",
      "s3:ReplicateDelete",
      "s3:ReplicateObject",
      "s3:ReplicateTags",
      "s3:RestoreObject",
      "s3:TagResource",
      "s3:UntagResource",
      "s3:UpdateStorageLensGroup",
    ]

    resources = [
      "arn:aws:s3:::elasticbeanstalk-*",
      "${module.deployment_pipeline_bucket.bucket_arn}"
    ]
  }