SECURITY: AllowS3OperationsOnElasticBeanstalkBuckets permits s3:*

[nodomain]

Describe the Bug

The permission policy of AllowS3OperationsOnElasticBeanstalkBuckets is too wide. Even if it is called like only allow to the Beanstalk buckets, it grants FULL S3 access to ALL buckets in the account.

This is a security hole and needs to be fixed.

Expected Behavior

Least possible permissions.

Steps to Reproduce

Deploy an environment and look at the IAM policies.

See https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/main/main.tf#L303

It even shows in the code that some security rules were skipped intentionally:

#bridgecrew:skip=BC_AWS_IAM_57:Skipping "Ensure IAM policies does not allow write access without constraint" 
#bridgecrew:skip=BC_AWS_IAM_56:Skipping "Ensure IAM policies do not allow permissions management / resource exposure without constraint"
#bridgecrew:skip=BC_AWS_IAM_55:Skipping "Ensure IAM policies do not allow data exfiltration"

Screenshots

No response

Environment

No response

Additional Context

No response