s3-restrict-public-read-buckets.yaml

apiVersion: v1
summary: Restrict public S3 buckets with READ permissions
description: This workflow looks at all of the public S3 buckets in a given account and restricts those that provide 'READ' access. Requires an AWS account with permissions to modify S3 buckets.
homepage: https://github.com/puppetlabs/relay-workflows/tree/master/s3-restrict-public-read-buckets
tags:
  - compliance

# Uncomment out this trigger to run this workflow hourly.
# triggers:
# - name: schedule
#   source:
#     type: schedule
#     schedule: '0 * * * *'
#   binding:
#     parameters:
#       dryRun: true

parameters:
  dryRun:
    description: True if this workflow should not actually modify buckets
    default: 'true'

steps:
- name: list-buckets
  image: relaysh/aws-s3-step-bucket-list
  spec:
    aws: &aws
      connection: !Connection { type: aws, name: my-aws-account }
- name: get-bucket-acls
  image: relaysh/aws-s3-step-bucket-get-acls
  spec:
    aws: *aws
    buckets: !Output {from: list-buckets, name: buckets}
- name: filter-buckets
  image: relaysh/core:latest-python
  spec:
    bucketACLs: !Output {from: get-bucket-acls, name: bucketACLs}
  inputFile: https://raw.githubusercontent.com/puppetlabs/relay-workflows/master/s3-restrict-public-read-buckets/filter-buckets.py
- name: approval
  description: Wait for approval to modify S3 buckets
  type: approval
  dependsOn: filter-buckets
  when:
    - !Fn.equals [!Parameter dryRun, 'false']
- name: modify-acls
  image: relaysh/aws-s3-step-bucket-put-acls
  dependsOn: approval
  when:
   - !Fn.equals [!Parameter dryRun, 'false']
  spec:
    aws: *aws
    buckets: !Output {from: filter-buckets, name: buckets}
    acl: private
    confetti: true