This is a repo containing a set of Sentinel policies that make sure your s3 is inline with AWS S3 security best practices.

The repo will be updated and expanded.

You can apply a free Terraform Cloud account from here.

Once you get a free acount, you can apply Terraform Cloud Governance trial in the Plan and Billing setting of your orgnization.

You can connect to this repo directly from Terraform Cloud or Terraform Enterprise following this link.

You can also fork into your own repo and edit sentinel.hcl to select the policies you want to use and enforcement level.

For example below Terraform code:

resource "aws_s3_bucket" "bucket-public-read-write-acl" {
  bucket = "bucket-public-read-write-acl"
  acl    = "public-read-write"


  tags = {
    owner = "yulei"
  }
}

Will result in:

Please raise any issues you have via this link.

You can create pull request to add more policies into this repo, it is expected that each of your policy should have at least one pass and one fail test case, and their corresponding mocks.

You can find the test cases in the test directory and mocks in mocks directory.