mcp-server-semgrep/semgrep-rules/json/aws/security/public-s3-policy-statement.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: public-s3-policy-statement
  pattern: |
    {
      "Effect": "Allow",
      "Principal": "*",
      "Resource": [
        ..., "=~/arn:aws:s3.*/", ...
      ],
      ...
    }
  message: >-
    Detected public S3 bucket policy. This policy allows anyone to access
    certain properties of or items in the bucket. Do not do this unless you
    will never have sensitive data inside the bucket.
  metadata:
    owasp:
    - A01:2021 - Broken Access Control
    cwe:
    - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls'
    references:
    - https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html
    category: security
    technology:
    - aws
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
  severity: WARNING
  languages:
  - json