tfsec: bug: Lots of false positives for S3 with 1.27.2

Thanks for this, I’ve found the problem. I’ve added a test for the above example to prevent regression too. Release coming shortly.

I do have similar issues with latest versions

resource "aws_s3_bucket" "this" {
  bucket        = local.resource_name
  force_destroy = var.deployment.delete_buckets
}

resource "aws_s3_bucket_acl" "this" {
  bucket = aws_s3_bucket.this.id
  acl    = "private"
}

resource "aws_s3_bucket_public_access_block" "this" {
  bucket = aws_s3_bucket.this.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

results in

• Result # 1 HIGH No public access block so not blocking public acls
• Result # 2 HIGH No public access block so not blocking public policies
• Result # 3 HIGH No public access block so not ignoring public acls
• Result # 4 HIGH No public access block so not restricting public buckets

Thanks, fix incoming (ETA 10 mins).

can confirm on my side 🙇🏼‍♂️

v1.27.5 is working now. Thanks @liamg for the quick reaction!