query terraform s3 bucket http policy query, action_check function cause false positive on iam policy document

[LupovichRan]

https://github.com/Checkmarx/kics/blob/1e1654ff52193635b301e4e06144353b9869ead3/assets/queries/terraform/aws/s3_bucket_policy_accepts_http_requests/query.rego

query terraform s3 bucket http policy query, action_check function cause false positive on iam policy document

Expected Behavior

Check the iam policy document to find out if deny http is found on created s3 bucket.

Actual Behavior

incorrect report that bucket is missing deny on http requests

Steps to Reproduce the Problem

data "aws_iam_policy_document" "bucket_test_policy" {

  statement {
    effect = "Deny"

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    actions = [
      "s3:*",
    ]


    resources = [
      "arn:aws:s3:::a/*",
      "arn:aws:s3:::a",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}


resource "aws_s3_bucket" "bucket_test_bucket" {
  bucket = "a"
  acl    = "private"
  policy = data.aws_iam_policy_document.bucket_test_policy.json
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
  versioning {
    enabled = true
  }
  tags = {
    Name      = "a"
    terraform = true
  }

}

resource "aws_s3_bucket_public_access_block" "bucket_test_block" {
  bucket = aws_s3_bucket.bucket_test_bucket.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Specifications

• Platform: Terraform \ AWS

[LupovichRan]

after study of the code and running local tests, it seems code supports iam policy document the errors comes from this function

validActions := {"*", "s3:*", "s3:GetObject"}

check_action(action) {
	is_string(action)
	action == validActions[x]
} else {
	action[a] == validActions[x]
}

commenting this line
#check_action(statement.Action)
solves the issue
@kaplanlior - can you please check the purpose of this check_action function ?
if its ok to comment it out - i'll open pull request for this change , or you prefer i'll remove the function and the array.

[LupovichRan]

resolved by #5415