Modify rule S6258: Update S3 bucket examples (APPSEC-989)

rules/S6258/cloudformation/rule.adoc

@@ -100,8 +100,8 @@ Resources:
     Type: "AWS::Redshift::Cluster"
     Properties:
       DBName: "Redshift Warehouse Cluster"
-----     
-      
+----
+
 For https://aws.amazon.com/opensearch-service/[Amazon OpenSearch] service or Amazon Elasticsearch service:
 
 [source,yaml]
@@ -169,19 +169,41 @@ For https://aws.amazon.com/s3/[Amazon S3 access requests]:
 ----
 AWSTemplateFormatVersion: 2010-09-09
 Resources:
-  S3BucketLogs:
-    Type: 'AWS::S3::Bucket'
-    Properties:
-      BucketName: "mycompliantloggingbucket"
-      AccessControl: LogDeliveryWrite
-
   S3Bucket:
     Type: 'AWS::S3::Bucket'
     Properties:
       BucketName: "mycompliantbucket"
       LoggingConfiguration:
-        DestinationBucketName: !Ref S3BucketLogs
+        DestinationBucketName: !Ref S3LoggingBucket
         LogFilePrefix: testing-logs
+  S3LoggingBucket:
+    Type: 'AWS::S3::Bucket'
+    Properties:
+      BucketName: "mycompliantloggingbucket"
+  S3BucketPolicy:
+    Type: 'AWS::S3::BucketPolicy'
+    Properties:
+      Bucket: !Ref S3LoggingBucket
+      PolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Action:
+              - 's3:PutObject'
+            Effect: Allow
+            Principal:
+              Service: logging.s3.amazonaws.com
+            Resource: !Join 
+              - ''
+              - - 'arn:aws:s3:::'
+                - !Ref S3LoggingBucket
+                - /*
+            Condition:
+              ArnLike:
+                'aws:SourceArn': !GetAtt 
+                  - S3Bucket
+                  - Arn
+              StringEquals:
+                'aws:SourceAccount': !Sub '${AWS::AccountId}'
 ----
 
 For https://aws.amazon.com/api-gateway/[Amazon API Gateway] stages:
@@ -259,8 +281,8 @@ Resources:
       Logs:
         Audit: true
         General: true
-----        
-        
+----
+
 For https://aws.amazon.com/redshift/[Amazon Redshift]:
 
 

rules/S6258/terraform/rule.adoc

@@ -118,25 +118,43 @@ resource "google_container_cluster" "example" {
 For Amazon https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket[S3 access requests]:
 [source,terraform]
 ----
-resource "aws_s3_bucket" "example-logs" {
-  bucket = "example_logstorage"
-  acl    = "log-delivery-write"
-}
-
 resource "aws_s3_bucket" "example" {
   bucket = "example"
-
-  logging { # AWS provider <= 3
-      target_bucket = aws_s3_bucket.example-logs.id
-      target_prefix = "log/example"
-  }
 }
 
-resource "aws_s3_bucket_logging" "example" { # AWS provider >= 4
+resource "aws_s3_bucket_logging" "example" {
   bucket = aws_s3_bucket.example.id
 
-  target_bucket = aws_s3_bucket.example-logs.id
-  target_prefix = "log/example"
+  target_bucket = aws_s3_bucket.logs.id
+  target_prefix = "testing-logs"
+}
+
+# Set up a logging bucket
+resource "aws_s3_bucket" "logs" {
+  bucket = "example_logstorage"
+}
+
+data "aws_iam_policy_document" "logs" {
+  statement {
+      sid    = "s3-log-delivery"
+      effect = "Allow"
+
+      principals {
+        type        = "Service"
+        identifiers = ["logging.s3.amazonaws.com"]
+      }
+
+      actions = ["s3:PutObject"]
+
+      resources = [
+        "${aws_s3_bucket.logs.arn}/*",
+      ]
+    }
+}
+
+resource "aws_s3_bucket_policy" "logs" {
+  bucket = aws_s3_bucket.example-logs.id
+  policy = data.aws_iam_policy_document.example.json
 }
 ----