← All challenges
mediumcloud~25 min

Stop a public S3 bucket in Terraform

A Terraform S3 bucket is public-read and unencrypted, a data breach waiting to happen. Fix the config to block public access and turn on encryption.

Scenario

This Terraform creates an S3 bucket that's public-read and has no encryption. That's the exact shape of countless real data leaks. Fix the config before it ships.

Your job

Edit main.tf so the bucket:

  • has no public ACL (remove acl = "public-read"),
  • has an aws_s3_bucket_public_access_block with all four flags true (block_public_acls, block_public_policy, ignore_public_acls, restrict_public_buckets), and
  • has server-side encryption configured (aws_s3_bucket_server_side_encryption_configuration, e.g. sse_algorithm = "AES256").

How it's graded

Structural check on the HCL (we parse the config, we don't run terraform apply), the same things a policy scanner like tfsec/Checkov flags.

Teaches: secure-by-default infrastructure-as-code, the controls that prevent the most common cloud data exposures.

What gets checked

Your solution is verified against each of these:

  • The bucket has no public-read ACL
  • A public access block sets all four protections to true
  • Server-side encryption is configured

Solve it in your browser

No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.

Solve in browser →

Prefer your own lab?

  1. Build the fix locally. New to the tooling? See setting up your lab.
  2. Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
  3. Submit the repo link. We review it by hand, confirm it works, and issue your proof page.
Submit your solution →