Correctly set actions in bucket access policy

sysdiglabs · Nov 2, 2023 · 8ec33e1 · 8ec33e1
1 parent 5a5a0b1
commit 8ec33e1
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 8 deletions.
diff --git a/templates_cloudlogs/CloudLogs.yaml b/templates_cloudlogs/CloudLogs.yaml
@@ -71,14 +71,14 @@ Resources:
  - Sid: "CloudlogsS3AccessGet"
  Effect: "Allow"
  Action:
- - "s3:Get*"
+ - "s3:List*"
  Resource:
  - !Sub '${BucketARN}'
  - !Sub '${BucketARN}/*'
  - Sid: "CloudlogsS3AccessList"
  Effect: "Allow"
  Action:
- - "s3:List*"
+ - "s3:Get*"
  Resource:
  - !Sub '${BucketARN}/AWSLogs/${AccountID}'
  - !Sub '${BucketARN}/AWSLogs/${AccountID}/*'

diff --git a/templates_cloudlogs/OrgCloudLogs.yaml b/templates_cloudlogs/OrgCloudLogs.yaml
@@ -78,14 +78,14 @@ Resources:
  - Sid: "CloudlogsS3AccessGet"
  Effect: "Allow"
  Action:
- - "s3:Get*"
+ - "s3:List*"
  Resource:
  - !Sub '${BucketARN}'
  - !Sub '${BucketARN}/*'
  - Sid: "CloudlogsS3AccessList"
  Effect: "Allow"
  Action:
- - "s3:List*"
+ - "s3:Get*"
  Resource:
  - !Sub '${BucketARN}/AWSLogs/${AccountID}'
  - !Sub '${BucketARN}/AWSLogs/${AccountID}/*'

diff --git a/templates_cspm_cloudlogs/FullInstall.yaml b/templates_cspm_cloudlogs/FullInstall.yaml
@@ -91,14 +91,14 @@ Resources:
  - Sid: "CloudlogsS3AccessGet"
  Effect: "Allow"
  Action:
- - "s3:Get*"
+ - "s3:List*"
  Resource:
  - !Sub '${BucketARN}'
  - !Sub '${BucketARN}/*'
  - Sid: "CloudlogsS3AccessList"
  Effect: "Allow"
  Action:
- - "s3:List*"
+ - "s3:Get*"
  Resource:
  - !Sub '${BucketARN}/AWSLogs/${AccountID}'
  - !Sub '${BucketARN}/AWSLogs/${AccountID}/*'

diff --git a/templates_cspm_cloudlogs/OrgFullInstall.yaml b/templates_cspm_cloudlogs/OrgFullInstall.yaml
@@ -96,14 +96,14 @@ Resources:
  - Sid: "CloudlogsS3AccessGet"
  Effect: "Allow"
  Action:
- - "s3:Get*"
+ - "s3:List*"
  Resource:
  - !Sub '${BucketARN}'
  - !Sub '${BucketARN}/*'
  - Sid: "CloudlogsS3AccessList"
  Effect: "Allow"
  Action:
- - "s3:List*"
+ - "s3:Get*"
  Resource:
  - !Sub '${BucketARN}/AWSLogs/${AccountID}'
  - !Sub '${BucketARN}/AWSLogs/${AccountID}/*'