mcp-server-semgrep/semgrep-rules/json/aws/security/public-s3-bucket.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: public-s3-bucket
  languages:
  - json
  message: >-
    Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The
    exact level of access
    and types of actions allowed will depend on the configuration of
    bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended
    values.
  metadata:
    category: security
    cwe:
    - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls'
    owasp:
    - A01:2021 - Broken Access Control
    references:
    - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
    technology:
    - aws
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
  patterns:
  - pattern-inside: |
      $BUCKETNAME: {
        "Type": "AWS::S3::Bucket",
        "Properties": {
        ...,
        },
        ...,
      }
  - pattern-either:
    - pattern: |
        "PublicAccessBlockConfiguration": {
             ...,
             "RestrictPublicBuckets": false,
             ...,
           },
    - pattern: |
        "PublicAccessBlockConfiguration": {
             ...,
             "IgnorePublicAcls": false,
             ...,
           },
    - pattern: |
        "PublicAccessBlockConfiguration": {
             ...,
             "BlockPublicAcls": false,
             ...,
           },
    - pattern: |
        "PublicAccessBlockConfiguration": {
             ...,
             "BlockPublicPolicy": false,
             ...,
           },
  severity: WARNING