Check-S3-Public.yml

policies:

  - name: s3-check-with-public-access
    resource: aws.s3
    comment: Checks if has some S3 bucket with public access
    filters:
      - or:
        - type: global-grants
        - type: cross-account
          everyone_only: true
    actions:
      - type: tag
        key: Cloud-Custodian-S3-With-Public-Access
        value: true

  - name: s3-tag-when-create-with-public-access
    resource: aws.s3
    comment: Checks if has some S3 bucket with public access
    mode:
      type: cloudtrail
      events:
        - CreateBucket
        - source: 's3.amazonaws.com'
          event: PutBucketPolicy
          ids: 'requestParameters.bucketName'
      role: arn:aws:iam::{account_id}:role/YOUR-CUSTODIAN-ROLE
      timeout: 200
    filters:
      - or:
        - type: global-grants
        - type: cross-account
          everyone_only: true
    actions:
      - type: tag
        key: Cloud-Custodian-S3-With-Public-Access
        value: true