airbnb / airbnb/binaryalert

Created S3 buckets should block public access

Open
#171 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.5k
Forks
179
PR merge metrics
No merged PRs in 30d

Description

## Background

It is a best practice to block public access to S3 buckets. The module currently creates a number of S3 buckets publicly.

## Desired Change

Something akin to the below. Perhaps it should be enabled by default, where a variable is provided to disable it if need be.

```hcl
resource "aws_s3_bucket_public_access_block" "block_binaryalert_bucket" {
bucket = BUCKET_IDs
restrict_public_buckets = true
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the Terraform module definitions for the S3 buckets created by BinaryAlert and review how their configuration variables are handled. Add default public-access blocking with the requested opt-out behavior, then validate that every created bucket is covered and run the available Terraform validation or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, terraform
Domain
cloud, infrastructure, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.