# ================================================================
# Attack path: Hello, anonymous bucket
# Difficulty: easy  ·  Cloud: aws  ·  Est. time: 10 min
#
# Starting position: Anonymous internet user, no AWS credentials.
# Objective:         List and download every object in the public S3 bucket.
#
# Playbook:
#   1. Discovers the bucket name via Google dorking, GitHub leaks, or a brute-force wordlist.
#   2. Lists contents anonymously: `aws s3 ls s3://<bucket> --no-sign-request` — public ACL allows unauthenticated reads.
#      exploits: S3-001, S3-004
#   3. Exfiltrates everything: `aws s3 sync s3://<bucket> ./loot --no-sign-request`.
#      exploits: S3-001
#
# Cleanup: terraform destroy -auto-approve   (or: aws cloudformation delete-stack)
# ================================================================

terraform {
  required_providers {
    aws    = { source = "hashicorp/aws",    version = "~> 5.0" }
    random = { source = "hashicorp/random", version = "~> 3.6" }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "random_id" "suffix" {
  byte_length = 4
}

# Public object bucket
# vulnerabilities: S3-001, S3-004, S3-010
resource "aws_s3_bucket" "data_public_bucket" {
  bucket        = "vbuild-public-${random_id.suffix.hex}"
  force_destroy = true
}

resource "aws_s3_bucket_ownership_controls" "data_public_bucket" {
  bucket = aws_s3_bucket.data_public_bucket.id
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

resource "aws_s3_bucket_public_access_block" "data_public_bucket" {
  bucket                  = aws_s3_bucket.data_public_bucket.id
  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}

resource "aws_s3_bucket_acl" "data_public_bucket" {
  depends_on = [
    aws_s3_bucket_ownership_controls.data_public_bucket,
    aws_s3_bucket_public_access_block.data_public_bucket,
  ]
  bucket = aws_s3_bucket.data_public_bucket.id
  acl    = "public-read-write"
}