module4/ec2-public-ingress-s3-readable-kms-decrypt.yml [3:25]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    description: filters for ec2 instances with security-groups with ingress rule allowing public access
    resource: ec2
    filters:
      - type: value
        key: PublicIpAddress
        value: not-null
      - type: value
        key: IamInstanceProfile
        value: not-null
      - type: security-group
        key: IpPermissions[].IpRanges[].CidrIp
        value_type: swap
        op: in
        value: "0.0.0.0/0" # anywhere
      - type: check-permissions
        match: allowed
        match-operator: or
        actions:
          - s3:GetObject
          - s3:GetObjectVersion
          - s3:PutBucketWebsite
          - s3:PutReplicationConfiguration
          - s3:*
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



module4/ec2-public-ingress.yml [3:26]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    description: filters for ec2 instances with security-groups with ingress rule allowing public access
    resource: ec2
    filters:
      - type: value
        key: PublicIpAddress
        value: not-null
      - type: value
        key: IamInstanceProfile
        value: not-null
      # describe level data does not appear to be available
      - type: security-group
        key: IpPermissions[].IpRanges[].CidrIp
        value_type: swap
        op: in
        value: "0.0.0.0/0" # anywhere
      - type: check-permissions
        match: allowed
        match-operator: or
        actions:
          - s3:GetObject
          - s3:GetObjectVersion
          - s3:PutBucketWebsite
          - s3:PutReplicationConfiguration
          - s3:*
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



