Skip to content

Commit 29adc4f

Browse files
garysassanogarysassano
authored
fix(sdk): remove unnecessary s3 bucket policy (#3926)
S3 Block Public Access is enabled by default for all new buckets created after April 2023 (see [HERE](https://aws.amazon.com/about-aws/whats-new/2023/04/amazon-s3-security-best-practices-buckets-default/)). *By submitting this pull request, I confirm that my contribution is made under the terms of the [Wing Cloud Contribution License](https://github.com/winglang/wing/blob/main/CONTRIBUTION_LICENSE.md)*.
1 parent b547c18 commit 29adc4f

File tree

50 files changed

+5
-1065
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+5
-1065
lines changed

‎libs/wingsdk/src/target-tf-aws/bucket.ts

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -206,14 +206,6 @@ export function createEncryptedBucket(
206206
policy: JSON.stringify(policy),
207207
dependsOn: [publicAccessBlock],
208208
});
209-
} else {
210-
new S3BucketPublicAccessBlock(scope, "PublicAccessBlock", {
211-
bucket: bucket.bucket,
212-
blockPublicAcls: true,
213-
blockPublicPolicy: true,
214-
ignorePublicAcls: true,
215-
restrictPublicBuckets: true,
216-
});
217209
}
218210

219211
return bucket;

‎libs/wingsdk/test/target-tf-aws/__snapshots__/bucket.test.ts.snap

Lines changed: 0 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -183,15 +183,6 @@ exports[`bucket prefix must be lowercase 1`] = `
183183
"force_destroy": false,
184184
},
185185
},
186-
"aws_s3_bucket_public_access_block": {
187-
"The-UncannyBucket_PublicAccessBlock_88AA9BF7": {
188-
"block_public_acls": true,
189-
"block_public_policy": true,
190-
"bucket": "\${aws_s3_bucket.The-UncannyBucket.bucket}",
191-
"ignore_public_acls": true,
192-
"restrict_public_buckets": true,
193-
},
194-
},
195186
"aws_s3_bucket_server_side_encryption_configuration": {
196187
"The-UncannyBucket_Encryption_4CFC1E98": {
197188
"bucket": "\${aws_s3_bucket.The-UncannyBucket.bucket}",
@@ -234,14 +225,6 @@ exports[`bucket prefix must be lowercase 2`] = `
234225
"id": "Encryption",
235226
"path": "root/Default/The-Uncanny.Bucket/Encryption",
236227
},
237-
"PublicAccessBlock": {
238-
"constructInfo": {
239-
"fqn": "cdktf.TerraformResource",
240-
"version": "0.17.0",
241-
},
242-
"id": "PublicAccessBlock",
243-
"path": "root/Default/The-Uncanny.Bucket/PublicAccessBlock",
244-
},
245228
},
246229
"constructInfo": {
247230
"fqn": "constructs.Construct",
@@ -335,15 +318,6 @@ exports[`bucket prefix valid 1`] = `
335318
"force_destroy": false,
336319
},
337320
},
338-
"aws_s3_bucket_public_access_block": {
339-
"the-uncannybucket_PublicAccessBlock_AC5BC68C": {
340-
"block_public_acls": true,
341-
"block_public_policy": true,
342-
"bucket": "\${aws_s3_bucket.the-uncannybucket.bucket}",
343-
"ignore_public_acls": true,
344-
"restrict_public_buckets": true,
345-
},
346-
},
347321
"aws_s3_bucket_server_side_encryption_configuration": {
348322
"the-uncannybucket_Encryption_78D02B71": {
349323
"bucket": "\${aws_s3_bucket.the-uncannybucket.bucket}",
@@ -417,14 +391,6 @@ exports[`bucket prefix valid 2`] = `
417391
"id": "Encryption",
418392
"path": "root/Default/the-uncanny.bucket/Encryption",
419393
},
420-
"PublicAccessBlock": {
421-
"constructInfo": {
422-
"fqn": "cdktf.TerraformResource",
423-
"version": "0.17.0",
424-
},
425-
"id": "PublicAccessBlock",
426-
"path": "root/Default/the-uncanny.bucket/PublicAccessBlock",
427-
},
428394
},
429395
"constructInfo": {
430396
"fqn": "constructs.Construct",
@@ -2939,15 +2905,6 @@ exports[`create a bucket 1`] = `
29392905
"force_destroy": false,
29402906
},
29412907
},
2942-
"aws_s3_bucket_public_access_block": {
2943-
"my_bucket_PublicAccessBlock_538547C0": {
2944-
"block_public_acls": true,
2945-
"block_public_policy": true,
2946-
"bucket": "\${aws_s3_bucket.my_bucket.bucket}",
2947-
"ignore_public_acls": true,
2948-
"restrict_public_buckets": true,
2949-
},
2950-
},
29512908
"aws_s3_bucket_server_side_encryption_configuration": {
29522909
"my_bucket_Encryption_3B1569A4": {
29532910
"bucket": "\${aws_s3_bucket.my_bucket.bucket}",
@@ -3021,14 +2978,6 @@ exports[`create a bucket 2`] = `
30212978
"id": "Encryption",
30222979
"path": "root/Default/my_bucket/Encryption",
30232980
},
3024-
"PublicAccessBlock": {
3025-
"constructInfo": {
3026-
"fqn": "cdktf.TerraformResource",
3027-
"version": "0.17.0",
3028-
},
3029-
"id": "PublicAccessBlock",
3030-
"path": "root/Default/my_bucket/PublicAccessBlock",
3031-
},
30322981
},
30332982
"constructInfo": {
30342983
"fqn": "constructs.Construct",

‎libs/wingsdk/test/target-tf-aws/__snapshots__/captures.test.ts.snap

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -342,15 +342,6 @@ exports[`function with bucket binding > put operation 2`] = `
342342
"bucket_prefix": "code-c84a50b1-",
343343
},
344344
},
345-
"aws_s3_bucket_public_access_block": {
346-
"Bucket_PublicAccessBlock_A34F3B5C": {
347-
"block_public_acls": true,
348-
"block_public_policy": true,
349-
"bucket": "\${aws_s3_bucket.Bucket.bucket}",
350-
"ignore_public_acls": true,
351-
"restrict_public_buckets": true,
352-
},
353-
},
354345
"aws_s3_bucket_server_side_encryption_configuration": {
355346
"Bucket_Encryption_016FDA0C": {
356347
"bucket": "\${aws_s3_bucket.Bucket.bucket}",

‎libs/wingsdk/test/target-tf-aws/__snapshots__/on-deploy.test.ts.snap

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,6 @@ exports[`execute OnDeploy after other resources 1`] = `
259259
"depends_on": [
260260
"aws_s3_bucket.my_bucket",
261261
"aws_s3_bucket_server_side_encryption_configuration.my_bucket_Encryption_3B1569A4",
262-
"aws_s3_bucket_public_access_block.my_bucket_PublicAccessBlock_538547C0",
263262
],
264263
"function_name": "\${aws_lambda_function.my_on_deploy_Function_59669FC0.function_name}",
265264
"input": "{}",
@@ -319,15 +318,6 @@ exports[`execute OnDeploy after other resources 1`] = `
319318
"force_destroy": false,
320319
},
321320
},
322-
"aws_s3_bucket_public_access_block": {
323-
"my_bucket_PublicAccessBlock_538547C0": {
324-
"block_public_acls": true,
325-
"block_public_policy": true,
326-
"bucket": "\${aws_s3_bucket.my_bucket.bucket}",
327-
"ignore_public_acls": true,
328-
"restrict_public_buckets": true,
329-
},
330-
},
331321
"aws_s3_bucket_server_side_encryption_configuration": {
332322
"my_bucket_Encryption_3B1569A4": {
333323
"bucket": "\${aws_s3_bucket.my_bucket.bucket}",
@@ -429,14 +419,6 @@ exports[`execute OnDeploy after other resources 2`] = `
429419
"id": "Encryption",
430420
"path": "root/Default/my_bucket/Encryption",
431421
},
432-
"PublicAccessBlock": {
433-
"constructInfo": {
434-
"fqn": "cdktf.TerraformResource",
435-
"version": "0.17.0",
436-
},
437-
"id": "PublicAccessBlock",
438-
"path": "root/Default/my_bucket/PublicAccessBlock",
439-
},
440422
},
441423
"constructInfo": {
442424
"fqn": "constructs.Construct",
@@ -636,18 +618,6 @@ exports[`execute OnDeploy before other resources 1`] = `
636618
"force_destroy": false,
637619
},
638620
},
639-
"aws_s3_bucket_public_access_block": {
640-
"my_bucket_PublicAccessBlock_538547C0": {
641-
"block_public_acls": true,
642-
"block_public_policy": true,
643-
"bucket": "\${aws_s3_bucket.my_bucket.bucket}",
644-
"depends_on": [
645-
"\${data.aws_lambda_invocation.my_on_deploy_Invocation_1A26E3B9}",
646-
],
647-
"ignore_public_acls": true,
648-
"restrict_public_buckets": true,
649-
},
650-
},
651621
"aws_s3_bucket_server_side_encryption_configuration": {
652622
"my_bucket_Encryption_3B1569A4": {
653623
"bucket": "\${aws_s3_bucket.my_bucket.bucket}",
@@ -752,14 +722,6 @@ exports[`execute OnDeploy before other resources 2`] = `
752722
"id": "Encryption",
753723
"path": "root/Default/my_bucket/Encryption",
754724
},
755-
"PublicAccessBlock": {
756-
"constructInfo": {
757-
"fqn": "cdktf.TerraformResource",
758-
"version": "0.17.0",
759-
},
760-
"id": "PublicAccessBlock",
761-
"path": "root/Default/my_bucket/PublicAccessBlock",
762-
},
763725
},
764726
"constructInfo": {
765727
"fqn": "constructs.Construct",

‎libs/wingsdk/test/target-tf-aws/__snapshots__/website.test.ts.snap

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -106,15 +106,6 @@ exports[`default website behavior 1`] = `
106106
"policy": "\${data.aws_iam_policy_document.Website_AllowDistributionReadOnly_24CFF6C0.json}",
107107
},
108108
},
109-
"aws_s3_bucket_public_access_block": {
110-
"Website_PublicAccessBlock_C196C11D": {
111-
"block_public_acls": true,
112-
"block_public_policy": true,
113-
"bucket": "\${aws_s3_bucket.Website_WebsiteBucket_3C0321F0.bucket}",
114-
"ignore_public_acls": true,
115-
"restrict_public_buckets": true,
116-
},
117-
},
118109
"aws_s3_bucket_server_side_encryption_configuration": {
119110
"Website_Encryption_5BBFE612": {
120111
"bucket": "\${aws_s3_bucket.Website_WebsiteBucket_3C0321F0.bucket}",
@@ -235,14 +226,6 @@ exports[`default website behavior 2`] = `
235226
"id": "File--inner-folder--a.html",
236227
"path": "root/Default/Website/File--inner-folder--a.html",
237228
},
238-
"PublicAccessBlock": {
239-
"constructInfo": {
240-
"fqn": "cdktf.TerraformResource",
241-
"version": "0.17.0",
242-
},
243-
"id": "PublicAccessBlock",
244-
"path": "root/Default/Website/PublicAccessBlock",
245-
},
246229
"WebsiteBucket": {
247230
"constructInfo": {
248231
"fqn": "cdktf.TerraformResource",
@@ -436,15 +419,6 @@ exports[`website with add_json 1`] = `
436419
"policy": "\${data.aws_iam_policy_document.Website_AllowDistributionReadOnly_24CFF6C0.json}",
437420
},
438421
},
439-
"aws_s3_bucket_public_access_block": {
440-
"Website_PublicAccessBlock_C196C11D": {
441-
"block_public_acls": true,
442-
"block_public_policy": true,
443-
"bucket": "\${aws_s3_bucket.Website_WebsiteBucket_3C0321F0.bucket}",
444-
"ignore_public_acls": true,
445-
"restrict_public_buckets": true,
446-
},
447-
},
448422
"aws_s3_bucket_server_side_encryption_configuration": {
449423
"Website_Encryption_5BBFE612": {
450424
"bucket": "\${aws_s3_bucket.Website_WebsiteBucket_3C0321F0.bucket}",
@@ -582,14 +556,6 @@ exports[`website with add_json 2`] = `
582556
"id": "File-config.json",
583557
"path": "root/Default/Website/File-config.json",
584558
},
585-
"PublicAccessBlock": {
586-
"constructInfo": {
587-
"fqn": "cdktf.TerraformResource",
588-
"version": "0.17.0",
589-
},
590-
"id": "PublicAccessBlock",
591-
"path": "root/Default/Website/PublicAccessBlock",
592-
},
593559
"WebsiteBucket": {
594560
"constructInfo": {
595561
"fqn": "cdktf.TerraformResource",

‎libs/wingsdk/test/target-tf-aws/bucket.test.ts

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ test("create a bucket", () => {
2121
// THEN
2222
expect(tfResourcesOf(output)).toEqual([
2323
"aws_s3_bucket", // main bucket
24-
"aws_s3_bucket_public_access_block", // ensure bucket is private
2524
"aws_s3_bucket_server_side_encryption_configuration", // server side encryption
2625
]);
2726
expect(tfSanitize(output)).toMatchSnapshot();

‎libs/wingsdk/test/target-tf-aws/captures.test.ts

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,6 @@ describe("function with bucket binding", () => {
5555
"aws_iam_role_policy_attachment",
5656
"aws_lambda_function",
5757
"aws_s3_bucket",
58-
"aws_s3_bucket_public_access_block",
5958
"aws_s3_bucket_server_side_encryption_configuration",
6059
"aws_s3_object",
6160
]);

‎libs/wingsdk/test/target-tf-aws/website.test.ts

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ test("default website behavior", () => {
2525
"aws_cloudfront_origin_access_control",
2626
"aws_s3_bucket",
2727
"aws_s3_bucket_policy",
28-
"aws_s3_bucket_public_access_block", // allow public access to an s3 bucket
2928
"aws_s3_bucket_server_side_encryption_configuration",
3029
"aws_s3_bucket_website_configuration",
3130
"aws_s3_object",
@@ -73,7 +72,6 @@ test("website with add_json", () => {
7372
"aws_cloudfront_origin_access_control",
7473
"aws_s3_bucket",
7574
"aws_s3_bucket_policy",
76-
"aws_s3_bucket_public_access_block", // allow public access to an s3 bucket
7775
"aws_s3_bucket_server_side_encryption_configuration",
7876
"aws_s3_bucket_website_configuration",
7977
"aws_s3_object",

0 commit comments

Comments
 (0)