@@ -0,0 +1,3022 @@
+#%0A# This file made available under CC0 1.0 Universal (https://creativecommons.org/publicdomain/zero/1.0/legalcode)%0A#%0A# Description: Check if any s3 bucket has bucket policy and if it does mark it non-compliant%0A#%0A# Trigger Type: Change Triggered%0A# Scope of Changes: S3:Instance%0A# Accepted Parameters: None%0A# Your Lambda function execution role will need to have a policy that provides the appropriate%0A# permissions.  Here is a policy that you can consider.  You should validate this for your own%0A# environment%0A#%7B%0A#    %22Version%22: %222012-10-17%22,%0A#    %22Statement%22: %5B%0A#        %7B%0A#            %22Effect%22: %22Allow%22,%0A#            %22Action%22: %5B%0A#                %22logs:CreateLogGroup%22,%0A#                %22logs:CreateLogStream%22,%0A#                %22logs:PutLogEvents%22%0A#            %5D,%0A#            %22Resource%22: %22arn:aws:logs:*:*:*%22%0A#        %7D,%0A#       %7B%0A#            %22Effect%22: %22Allow%22,%0A#            %22Action%22: %5B%0A#                %22config:PutEvaluations%22%0A#            %5D,%0A#            %22Resource%22: %22*%22%0A#        %7D%0A#    %5D%0A#%7D%0A#%0A%0Aimport boto3%0Aimport json%0Aimport logging%0A%0Alog = logging.getLogger()%0Alog.setLevel(logging.DEBUG)%0AAPPLICABLE_RESOURCES = %5B%22AWS::S3::Bucket%22%5D%0A%0A%0Adef evaluate_compliance(configuration_item):%0A    if configuration_item%5B%22resourceType%22%5D not in APPLICABLE_RESOURCES:%0A        return %7B%0A            %22compliance_type%22: %22NOT_APPLICABLE%22,%0A            %22annotation%22: %22The rule doesn't apply to resources of type %22 +%0A            configuration_item%5B%22resourceType%22%5D + %22.%22%0A        %7D%0A%0A    if configuration_item%5B'configurationItemStatus'%5D == %22ResourceDeleted%22:%0A        return %7B%0A            %22compliance_type%22: %22NOT_APPLICABLE%22,%0A            %22annotation%22: %22The configurationItem was deleted %22 +%0A                          %22and therefore cannot be validated%22%0A        %7D%0A%0A    bucket_policy = configuration_item%5B%22supplementaryConfiguration%22%5D.get(%22BucketPolicy%22)%0A    if bucket_policy%5B'policyText'%5D is None:%0A        return %7B%0A            %22compliance_type%22: %22COMPLIANT%22,%0A            %22annotation%22: 'Bucket Policy does not exists'%0A        %7D%0A%0A    else:%0A        return %7B%0A            %22compliance_type%22: %22NON_COMPLIANT%22,%0A            %22annotation%22: 'Bucket Policy exists'%0A        %7D%0A%0A%0Adef lambda_handler(event, context):%0A    log.debug('Event %25s', event)%0A    invoking_event      = json.loads(event%5B'invokingEvent'%5D)%0A    configuration_item  = invoking_event%5B%22configurationItem%22%5D%0A    evaluation          = evaluate_compliance(configuration_item)%0A    config              = boto3.client('config')%0A%0A    config.put_evaluations(%0A       Evaluations=%5B%0A           %7B%0A               'ComplianceResourceType':    invoking_event%5B'configurationItem'%5D%5B'resourceType'%5D,%0A               'ComplianceResourceId':      invoking_event%5B'configurationItem'%5D%5B'resourceId'%5D,%0A               'ComplianceType':            evaluation%5B%22compliance_type%22%5D,%0A               %22Annotation%22:                evaluation%5B%22annotation%22%5D,%0A               'OrderingTimestamp':         invoking_event%5B'configurationItem'%5D%5B'configurationItemCaptureTime'%5D%0A           %7D,%0A       %5D,%0A       ResultToken=event%5B'resultToken'%5D)%0A

Check if any s3 bucket has bucket policy and if it does mark it non-compliant (#62)