Need

Secure access to debug APK files

Context

• Usage of Terraform for Infrastructure as Code (IaC)
• Usage of AWS SDK for interacting with Amazon Web Services

Description

Non compliant code

        provider "aws" {
  region = "us-west-2"
}

resource "aws_s3_bucket" {
  bucket = "my_bucket"
  acl    = "public-read"

  tags = {
    Name        = "My bucket"
    Environment = "Dev"
  }
}

resource "aws_s3_bucket_object" {
  bucket = "my_bucket"
  key    = "debug.apk"
  source = "path/to/local/file/debug.apk"
  acl    = "public-read"
}
        
        

This Terraform script is used to create an S3 bucket on AWS and upload a file to it. In this case, the file is a debug APK.

The vulnerability lies in the access control list (ACL) settings of both the S3 bucket and the object. The acl attribute is set to public-read, which means that any user, authenticated or not, can read the file. In this case, the debug APK is publicly accessible, which is a security risk.

The debug version of an application can contain sensitive information, such as keys, passwords, and other details that should not be exposed. It might also have fewer security controls than the production version, making it a potential target for attackers.

Moreover, the S3 bucket itself is also publicly readable, which could expose other files or information.

Therefore, the acl attribute should be changed to a more restrictive setting to prevent unauthorized access. The debug APK should not be stored in a publicly accessible location.

Steps

• Remove the 'acl' attribute from the 'aws_s3_bucket' resource to prevent public access to the bucket.
• Implement authentication mechanisms, such as AWS IAM roles or access keys, to restrict access to the bucket and its objects.
• Consider using AWS S3 bucket policies to further control access to the bucket and its objects.
• Ensure that the debug APK is not included in the production build and is only accessible to authorized users during development and testing phases.

Compliant code

        provider "aws" {
  region = "us-west-2"
}

resource "aws_s3_bucket" {
  bucket = "my_bucket"

  tags = {
    Name        = "My bucket"
    Environment = "Dev"
  }
}

resource "aws_s3_bucket_object" {
  bucket = "my_bucket"
  key    = "debug.apk"
  source = "path/to/local/file/debug.apk"
}
        
        

The above code is a Terraform script for AWS infrastructure. It creates an S3 bucket and uploads a debug APK file to it. However, the original code had a vulnerability where the S3 bucket and the debug APK file were publicly accessible, which could lead to unauthorized access.

The fixed code removes the 'acl' attribute from the 'aws_s3_bucket' and 'aws_s3_bucket_object' resources, which was previously set to 'public-read'. This change prevents public access to the bucket and its objects.

In addition to this, it's recommended to implement authentication mechanisms, such as AWS IAM roles or access keys, to restrict access to the bucket and its objects. AWS S3 bucket policies can also be used to further control access to the bucket and its objects.

Lastly, it's important to ensure that the debug APK is not included in the production build and is only accessible to authorized users during development and testing phases. This can be achieved by setting up different environments for development, testing, and production, and using appropriate access controls for each environment.

References

• 202. Unauthorized access to files - Debug APK