let s3_buckets = Resources.*[
	Type == "AWS::S3::Bucket"
]

rule s3_access_logging when %s3_buckets !empty {
	%s3_buckets {
		Properties {
			LoggingConfiguration exists <<Logging is not configured.>>
		}
	}
}

rule s3_bucket_versioning when %s3_buckets !empty {
	%s3_buckets {
		Properties {
			VersioningConfiguration exists <<Bucket versioning is not configured (i.e. disabled).>>
			when VersioningConfiguration exists {
				VersioningConfiguration {
					Status exists <<Bucket versioning status is not configured (i.e. disabled).>>
					when Status exists {
						Status == "Enabled" <<Bucket versioning is not enabled.>>
					}
				}
			}
		}
	}
}

rule s3_bucket_object_lock_enabled when %s3_buckets !empty {
	%s3_buckets {
		Properties {
			ObjectLockEnabled exists <<ObjectLockEnabled is not set (i.e. disabled).>>
			when ObjectLockEnabled exists {
				ObjectLockEnabled == true <<Object Lock is disabled.>>
			}
		}
	}
}

rule s3_bucket_encryption when %s3_buckets !empty {
	%s3_buckets {
		Properties {
			BucketEncryption exists <<BucketEncryption is not configured. (i.e. disabled)>>
			when BucketEncryption exists {
				BucketEncryption {
					some ServerSideEncryptionConfiguration.* {
						ServerSideEncryptionByDefault exists <<ServerSideEncryptionByDefault is not configured. (i.e. disabled)>>
					}
				}
			}
		}
	}
}

rule s3_bucket_kms_encryption when %s3_buckets !empty {
	%s3_buckets {
		Properties {
			BucketEncryption exists <<BucketEncryption is not configured. (i.e. disabled)>>
			when BucketEncryption exists {
				BucketEncryption {
					some ServerSideEncryptionConfiguration.* {
						ServerSideEncryptionByDefault exists <<ServerSideEncryptionByDefault is not configured. (i.e. disabled)>>
						when ServerSideEncryptionByDefault exists {
							ServerSideEncryptionByDefault {
								SSEAlgorithm == "aws:kms" <<KMS encryptionm not used.>>
							}
						}
					}
				}
			}
		}
	}
}

rule s3_bucket_key_enabled when %s3_buckets !empty {
	%s3_buckets {
		Properties {
			when BucketEncryption exists {
				BucketEncryption {
					some ServerSideEncryptionConfiguration.* {
						when ServerSideEncryptionByDefault exists {
							when ServerSideEncryptionByDefault.SSEAlgorithm == "aws:kms" {
								BucketKeyEnabled == true <<Bucket Key is disabled.>>
							}
						}
					}
				}
			}
		}
	}
}