S3 Block Public Access Bucket Level Policy

1# Approximation of HashiCorp PCI DSS Sentinel example: s3-block-public-access-bucket-level.sentinel
2# Exact conversion quality: Not convertible
3
4locals {
5    all_public_access_blocks = core::getresources("aws_s3_bucket_public_access_block", {})
6    compliant_public_access_blocks = {
7        for block in local.all_public_access_blocks :
8        core::try(block.bucket, "") => (
9            core::try(block.ignore_public_acls, false) == true &&
10            core::try(block.restrict_public_buckets, false) == true &&
11            core::try(block.block_public_acls, false) == true &&
12            core::try(block.block_public_policy, false) == true
13        )
14    }
15}
16
17resource_policy "aws_s3_bucket" "s3_block_public_access_bucket_level" {
18    locals {
19        bucket_name = core::try(attrs.bucket, "")
20        block_is_compliant = core::try(local.compliant_public_access_blocks[local.bucket_name], false)
21    }
22
23    enforce {
24        condition = local.block_is_compliant
25        error_message = "S3 buckets should have a matching aws_s3_bucket_public_access_block with all four public access settings enabled"
26    }
27}