Deny the buckets that are actually public

Objectives

A platform engineer swears the storage policy is enforced: the rule denies any bucket with `acl == "public-read"`. Last week a bucket went public anyway: it had a private ACL and a bucket policy granting `*` read access.

Write deny rules over `input` that catch both shapes: the public ACL, and a private-ACL bucket whose policy principal is a wildcard. Encryption-off buckets should not be denied by this rule: that is a different control, and denying it here would hide the finding you were asked for.

# should be DENIED
{ "name": "logs",    "acl": "public-read", "policy_principal": "arn:aws:iam::1:root", "encrypted": true }
{ "name": "exports", "acl": "private",     "policy_principal": "*",                   "encrypted": true }

# should be ALLOWED
{ "name": "backups", "acl": "private",     "policy_principal": "arn:aws:iam::1:root", "encrypted": true }
{ "name": "scratch", "acl": "private",     "policy_principal": "arn:aws:iam::1:root", "encrypted": false }

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Re-read the brief and name the trap

   "The policy is enforced" was true and useless: it enforced one of the two ways a bucket becomes public. A rule that covers a subset of the failure modes is more dangerous than no rule, because it produces confidence.

   There is a second trap at the end of the brief: a tempting extra condition you are explicitly told not to enforce here.

2. Step 2

   Read the fixture as a truth table

   Four inputs, split into the two that must be denied and the two that must be allowed. Compare them field by field and identify which single field distinguishes each denied bucket from the allowed ones.

   Pay attention to the fourth input: it differs from the third only in a field that is none of this rule's business.

3. Step 3

   Read the starter

   The starter already handles one of the two denial paths correctly, with a message that describes why. Keep it. The exercise is what you add beside it.

4. Step 4

   How Rego composes conditions

   Conditions inside a single deny block are ANDed: every line must hold. Separate deny blocks are ORed: any one of them firing produces a denial.

   So ask: are my two public-bucket shapes both required at once, or are they alternatives? The answer tells you whether to add lines or to add a block.

   Rule parses and declares at least one deny blockDenies the public-ACL bucket

5. Step 5

   Catch the second shape

   The second denied bucket looks locked down by ACL. The only field that exposes it is the one describing who the bucket policy grants to, and the giveaway is a principal that names everyone rather than an account.

   Give this block its own message: the deny text is what an engineer reads when their build fails, so it should say which of the two shapes tripped.

   Denies the wildcard-principal bucket

6. Step 6

   Do not over-deny

   Two inputs must survive your rules untouched. Re-run your logic mentally against them and confirm neither matches any block.

   In particular, resist adding a condition about encryption. It is a real problem, it belongs to a different control, and folding it in here makes this rule's deny message lie.

   Allows the properly locked-down bucketDoes not deny on encryption: wrong control

7. Step 7

   Run and read the failures

   If the allow check fails, a block is too broad. If the wildcard check fails, your second condition is probably sitting inside the first block and being ANDed with the ACL test.

Rules summary

• XP on pass

  45 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 11 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.