Resource-based policies granting access to all users can lead to information leakage.

Why is this an issue?

Resource-based policies in AWS define who can access a resource and what actions they can perform. When the Principal element of a policy is set to "*", access is granted to all users, including anonymous and unauthenticated ones. This violates the principle of least privilege and can expose sensitive data or operations to unauthorized parties.

What is the potential impact?

Unauthorized data access

When a resource-based policy grants access to all principals, any user on the internet can read, modify, or delete the resource’s contents. This can lead to data breaches, exposure of sensitive information, and potential misuse of cloud resources.

How to fix it in AWS CDK

Use a specific principal such as AccountRootPrincipal instead of AnyPrincipal.

Code examples

Noncompliant code example

import { aws_iam as iam } from 'aws-cdk-lib'
import { aws_s3 as s3 } from 'aws-cdk-lib'

const bucket = new s3.Bucket(this, "ExampleBucket")

bucket.addToResourcePolicy(new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: ["s3:*"],
    resources: [bucket.arnForObjects("*")],
    principals: [new iam.AnyPrincipal()] // Noncompliant
}))

Compliant solution

import { aws_iam as iam } from 'aws-cdk-lib'
import { aws_s3 as s3 } from 'aws-cdk-lib'

const bucket = new s3.Bucket(this, "ExampleBucket")

bucket.addToResourcePolicy(new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: ["s3:*"],
    resources: [bucket.arnForObjects("*")],
    principals: [new iam.AccountRootPrincipal()]
}))

Resources

Documentation

Standards