1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# main.tf — STR violations fixture
# Triggers all 7 STR policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# STR-001 — Public access block missing (no aws_s3_bucket_public_access_block)
# STR-004 — Encryption missing (no aws_s3_bucket_server_side_encryption_configuration)
# STR-005 — No bucket policy at all
# STR-007 — Ownership controls missing
resource "aws_s3_bucket" "bad_bucket" {
  bucket = "bad-bucket"
}

# STR-001 — Public access block exists but flags disabled
resource "aws_s3_bucket_public_access_block" "bad_pab" {
  bucket                  = aws_s3_bucket.bad_bucket.id
  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}

# STR-002 + STR-003 + STR-005 + STR-006 — Public read/write, no TLS deny, wildcard principal
resource "aws_s3_bucket_policy" "bad_policy" {
  bucket = aws_s3_bucket.bad_bucket.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = "*"
        Action    = ["s3:GetObject", "s3:PutObject"]
        Resource  = "arn:aws:s3:::bad-bucket/*"
      }
    ]
  })
}

# STR-007 — Wrong object ownership
resource "aws_s3_bucket_ownership_controls" "bad_ownership" {
  bucket = aws_s3_bucket.bad_bucket.id
  rule {
    object_ownership = "ObjectWriter"
  }
}