feat: add support for aws_s3_account_public_access_block

enumeration/remote/aws/client/mock_AwsClientFactoryInterface.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.3.0. DO NOT EDIT.
+// Code generated by mockery v2.14.0. DO NOT EDIT.
 
 package client
 
@@ -6,6 +6,8 @@ import (
 	aws "github.com/aws/aws-sdk-go/aws"
 	mock "github.com/stretchr/testify/mock"
 
+	s3controliface "github.com/aws/aws-sdk-go/service/s3control/s3controliface"
+
 	s3iface "github.com/aws/aws-sdk-go/service/s3/s3iface"
 )
 
@@ -35,3 +37,40 @@ func (_m *MockAwsClientFactoryInterface) GetS3Client(configs ...*aws.Config) s3i
 
 	return r0
 }
+
+// GetS3ControlClient provides a mock function with given fields: configs
+func (_m *MockAwsClientFactoryInterface) GetS3ControlClient(configs ...*aws.Config) s3controliface.S3ControlAPI {
+	_va := make([]interface{}, len(configs))
+	for _i := range configs {
+		_va[_i] = configs[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 s3controliface.S3ControlAPI
+	if rf, ok := ret.Get(0).(func(...*aws.Config) s3controliface.S3ControlAPI); ok {
+		r0 = rf(configs...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(s3controliface.S3ControlAPI)
+		}
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewMockAwsClientFactoryInterface interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewMockAwsClientFactoryInterface creates a new instance of MockAwsClientFactoryInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewMockAwsClientFactoryInterface(t mockConstructorTestingTNewMockAwsClientFactoryInterface) *MockAwsClientFactoryInterface {
+	mock := &MockAwsClientFactoryInterface{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

enumeration/remote/aws/client/s3_client_factory.go

@@ -5,10 +5,13 @@ import (
 	"github.com/aws/aws-sdk-go/aws/client"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/aws/aws-sdk-go/service/s3/s3iface"
+	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/aws/aws-sdk-go/service/s3control/s3controliface"
 )
 
 type AwsClientFactoryInterface interface {
 	GetS3Client(configs ...*aws.Config) s3iface.S3API
+	GetS3ControlClient(configs ...*aws.Config) s3controliface.S3ControlAPI
 }
 
 type AwsClientFactory struct {
@@ -22,3 +25,7 @@ func NewAWSClientFactory(config client.ConfigProvider) *AwsClientFactory {
 func (s AwsClientFactory) GetS3Client(configs ...*aws.Config) s3iface.S3API {
 	return s3.New(s.config, configs...)
 }
+
+func (s AwsClientFactory) GetS3ControlClient(configs ...*aws.Config) s3controliface.S3ControlAPI {
+	return s3control.New(s.config, configs...)
+}

enumeration/remote/aws/init.go

@@ -3,7 +3,7 @@ package aws
 import (
 	"github.com/snyk/driftctl/enumeration"
 	"github.com/snyk/driftctl/enumeration/alerter"
-	"github.com/snyk/driftctl/enumeration/remote/aws/client"
+	client "github.com/snyk/driftctl/enumeration/remote/aws/client"
 	"github.com/snyk/driftctl/enumeration/remote/aws/repository"
 	"github.com/snyk/driftctl/enumeration/remote/cache"
 	"github.com/snyk/driftctl/enumeration/remote/common"
@@ -35,6 +35,7 @@ func Init(version string, alerter alerter.AlerterInterface, providerLibrary *ter
 	repositoryCache := cache.New(100)
 
 	s3Repository := repository.NewS3Repository(client.NewAWSClientFactory(provider.session), repositoryCache)
+	s3ControlRepository := repository.NewS3ControlRepository(client.NewAWSClientFactory(provider.session), provider.accountId, repositoryCache)
 	ec2repository := repository.NewEC2Repository(provider.session, repositoryCache)
 	elbv2Repository := repository.NewELBV2Repository(provider.session, repositoryCache)
 	route53repository := repository.NewRoute53Repository(provider.session, repositoryCache)
@@ -71,6 +72,7 @@ func Init(version string, alerter alerter.AlerterInterface, providerLibrary *ter
 	remoteLibrary.AddEnumerator(NewS3BucketAnalyticEnumerator(s3Repository, factory, provider.Config, alerter))
 	remoteLibrary.AddDetailsFetcher(aws.AwsS3BucketAnalyticsConfigurationResourceType, common.NewGenericDetailsFetcher(aws.AwsS3BucketAnalyticsConfigurationResourceType, provider, deserializer))
 	remoteLibrary.AddEnumerator(NewS3BucketPublicAccessBlockEnumerator(s3Repository, factory, provider.Config, alerter))
+	remoteLibrary.AddEnumerator(NewS3AccountPublicAccessBlockEnumerator(s3ControlRepository, factory, provider.Config, alerter))
 
 	remoteLibrary.AddEnumerator(NewEC2EbsVolumeEnumerator(ec2repository, factory))
 	remoteLibrary.AddDetailsFetcher(aws.AwsEbsVolumeResourceType, common.NewGenericDetailsFetcher(aws.AwsEbsVolumeResourceType, provider, deserializer))

enumeration/remote/aws/provider.go

@@ -1,6 +1,7 @@
 package aws
 
 import (
+	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/sts"
@@ -42,9 +43,10 @@ type awsConfig struct {
 
 type AWSTerraformProvider struct {
 	*terraform.TerraformProvider
-	session *session.Session
-	name    string
-	version string
+	session   *session.Session
+	name      string
+	version   string
+	accountId string
 }
 
 func NewAWSTerraformProvider(version string, progress enumeration.ProgressCounter, configDir string) (*AWSTerraformProvider, error) {
@@ -115,11 +117,13 @@ func (p *AWSTerraformProvider) CheckCredentialsExist() error {
 	// This call is to make sure that the credentials are valid
 	// A more complex logic exist in terraform provider, but it's probably not worth to implement it
 	// https://github.com/hashicorp/terraform-provider-aws/blob/e3959651092864925045a6044961a73137095798/aws/auth_helpers.go#L111
-	_, err = sts.New(p.session).GetCallerIdentity(&sts.GetCallerIdentityInput{})
+	identity, err := sts.New(p.session).GetCallerIdentity(&sts.GetCallerIdentityInput{})
 	if err != nil {
 		logrus.Debug(err)
 		return errors.New("Could not authenticate successfully on AWS with the provided credentials.\n" +
 			"Please refer to the AWS documentation: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html\n")
 	}
+
+	p.accountId = aws.StringValue(identity.Account)
 	return nil
 }

enumeration/remote/aws/repository/mock_S3ControlRepository.go

@@ -0,0 +1,65 @@
+// Code generated by mockery v2.14.0. DO NOT EDIT.
+
+package repository
+
+import (
+	s3control "github.com/aws/aws-sdk-go/service/s3control"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockS3ControlRepository is an autogenerated mock type for the S3ControlRepository type
+type MockS3ControlRepository struct {
+	mock.Mock
+}
+
+// DescribeAccountPublicAccessBlock provides a mock function with given fields:
+func (_m *MockS3ControlRepository) DescribeAccountPublicAccessBlock() (*s3control.PublicAccessBlockConfiguration, error) {
+	ret := _m.Called()
+
+	var r0 *s3control.PublicAccessBlockConfiguration
+	if rf, ok := ret.Get(0).(func() *s3control.PublicAccessBlockConfiguration); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*s3control.PublicAccessBlockConfiguration)
+		}
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetAccountID provides a mock function with given fields:
+func (_m *MockS3ControlRepository) GetAccountID() string {
+	ret := _m.Called()
+
+	var r0 string
+	if rf, ok := ret.Get(0).(func() string); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewMockS3ControlRepository interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewMockS3ControlRepository creates a new instance of MockS3ControlRepository. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewMockS3ControlRepository(t mockConstructorTestingTNewMockS3ControlRepository) *MockS3ControlRepository {
+	mock := &MockS3ControlRepository{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

enumeration/remote/aws/repository/s3_repository.go

@@ -2,6 +2,7 @@ package repository
 
 import (
 	"fmt"
+
 	"github.com/snyk/driftctl/enumeration/remote/aws/client"
 	"github.com/snyk/driftctl/enumeration/remote/cache"
 

enumeration/remote/aws/repository/s3control_repository.go

@@ -0,0 +1,49 @@
+package repository
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/snyk/driftctl/enumeration/remote/aws/client"
+	"github.com/snyk/driftctl/enumeration/remote/cache"
+)
+
+type S3ControlRepository interface {
+	DescribeAccountPublicAccessBlock() (*s3control.PublicAccessBlockConfiguration, error)
+	GetAccountID() string
+}
+
+type s3ControlRepository struct {
+	clientFactory client.AwsClientFactoryInterface
+	accountId     string
+	cache         cache.Cache
+}
+
+func NewS3ControlRepository(factory client.AwsClientFactoryInterface, accountId string, c cache.Cache) *s3ControlRepository {
+	return &s3ControlRepository{
+		clientFactory: factory,
+		accountId:     accountId,
+		cache:         c,
+	}
+}
+func (s *s3ControlRepository) GetAccountID() string {
+	return s.accountId
+}
+
+func (s *s3ControlRepository) DescribeAccountPublicAccessBlock() (*s3control.PublicAccessBlockConfiguration, error) {
+	cacheKey := "S3DescribeAccountPublicAccessBlock"
+	if v := s.cache.Get(cacheKey); v != nil {
+		return v.(*s3control.PublicAccessBlockConfiguration), nil
+	}
+	out, err := s.clientFactory.GetS3ControlClient(nil).GetPublicAccessBlock(&s3control.GetPublicAccessBlockInput{
+		AccountId: aws.String(s.accountId),
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	result := out.PublicAccessBlockConfiguration
+
+	s.cache.Put(cacheKey, result)
+	return result, nil
+}

enumeration/remote/aws/repository/s3control_repository_test.go

@@ -0,0 +1,91 @@
+package repository
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/snyk/driftctl/enumeration/remote/aws/client"
+	"github.com/snyk/driftctl/enumeration/remote/cache"
+	"github.com/stretchr/testify/mock"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/r3labs/diff/v2"
+	awstest "github.com/snyk/driftctl/test/aws"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_s3ControlRepository_DescribeAccountPublicAccessBlock(t *testing.T) {
+
+	tests := []struct {
+		name    string
+		mocks   func(client *awstest.MockFakeS3Control)
+		want    *s3control.PublicAccessBlockConfiguration
+		wantErr error
+	}{
+		{
+			name: "describe account public accessblock",
+			mocks: func(client *awstest.MockFakeS3Control) {
+				client.On("GetPublicAccessBlock", mock.Anything).Return(
+					&s3control.GetPublicAccessBlockOutput{
+						PublicAccessBlockConfiguration: &s3control.PublicAccessBlockConfiguration{
+							BlockPublicAcls:       aws.Bool(false),
+							BlockPublicPolicy:     aws.Bool(true),
+							IgnorePublicAcls:      aws.Bool(false),
+							RestrictPublicBuckets: aws.Bool(true),
+						},
+					},
+					nil,
+				).Once()
+			},
+			want: &s3control.PublicAccessBlockConfiguration{
+				BlockPublicAcls:       aws.Bool(false),
+				BlockPublicPolicy:     aws.Bool(true),
+				IgnorePublicAcls:      aws.Bool(false),
+				RestrictPublicBuckets: aws.Bool(true),
+			},
+		},
+		{
+			name: "Error detting account public accessblock",
+			mocks: func(client *awstest.MockFakeS3Control) {
+				client.On("GetPublicAccessBlock", mock.Anything).Return(
+					nil,
+					awserr.NewRequestFailure(nil, 403, ""),
+				).Once()
+			},
+			want:    nil,
+			wantErr: awserr.NewRequestFailure(nil, 403, ""),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := cache.New(1)
+			mockedClient := &awstest.MockFakeS3Control{}
+			tt.mocks(mockedClient)
+			factory := client.MockAwsClientFactoryInterface{}
+			factory.On("GetS3ControlClient", (*aws.Config)(nil)).Return(mockedClient).Once()
+			r := NewS3ControlRepository(&factory, "", store)
+			got, err := r.DescribeAccountPublicAccessBlock()
+			factory.AssertExpectations(t)
+			assert.Equal(t, tt.wantErr, err)
+
+			if err == nil {
+				// Check that results were cached
+				cachedData, err := r.DescribeAccountPublicAccessBlock()
+				assert.NoError(t, err)
+				assert.Equal(t, got, cachedData)
+				assert.IsType(t, &s3control.PublicAccessBlockConfiguration{}, store.Get("S3DescribeAccountPublicAccessBlock"))
+			}
+
+			changelog, err := diff.Diff(got, tt.want)
+			assert.Nil(t, err)
+			if len(changelog) > 0 {
+				for _, change := range changelog {
+					t.Errorf("%s: %s -> %s", strings.Join(change.Path, "."), change.From, change.To)
+				}
+				t.Fail()
+			}
+		})
+	}
+}

enumeration/remote/aws/s3_account_public_access_block_enumerator.go

@@ -0,0 +1,56 @@
+package aws
+
+import (
+	awssdk "github.com/aws/aws-sdk-go/aws"
+	"github.com/snyk/driftctl/enumeration/alerter"
+	"github.com/snyk/driftctl/enumeration/remote/aws/repository"
+	remoteerror "github.com/snyk/driftctl/enumeration/remote/error"
+	tf "github.com/snyk/driftctl/enumeration/remote/terraform"
+	"github.com/snyk/driftctl/enumeration/resource"
+	"github.com/snyk/driftctl/enumeration/resource/aws"
+)
+
+type S3AccountPublicAccessBlockEnumerator struct {
+	repository     repository.S3ControlRepository
+	factory        resource.ResourceFactory
+	providerConfig tf.TerraformProviderConfig
+	alerter        alerter.AlerterInterface
+}
+
+func NewS3AccountPublicAccessBlockEnumerator(repo repository.S3ControlRepository, factory resource.ResourceFactory, providerConfig tf.TerraformProviderConfig, alerter alerter.AlerterInterface) *S3AccountPublicAccessBlockEnumerator {
+	return &S3AccountPublicAccessBlockEnumerator{
+		repository:     repo,
+		factory:        factory,
+		providerConfig: providerConfig,
+		alerter:        alerter,
+	}
+}
+
+func (e *S3AccountPublicAccessBlockEnumerator) SupportedType() resource.ResourceType {
+	return aws.AwsS3AccountPublicAccessBlock
+}
+
+func (e *S3AccountPublicAccessBlockEnumerator) Enumerate() ([]*resource.Resource, error) {
+	accountPublicAccessBlock, err := e.repository.DescribeAccountPublicAccessBlock()
+	if err != nil {
+		return nil, remoteerror.NewResourceListingError(err, string(e.SupportedType()))
+	}
+
+	results := make([]*resource.Resource, 0, 1)
+
+	results = append(
+		results,
+		e.factory.CreateAbstractResource(
+			string(e.SupportedType()),
+			e.repository.GetAccountID(),
+			map[string]interface{}{
+				"block_public_acls":       awssdk.BoolValue(accountPublicAccessBlock.BlockPublicAcls),
+				"block_public_policy":     awssdk.BoolValue(accountPublicAccessBlock.BlockPublicPolicy),
+				"ignore_public_acls":      awssdk.BoolValue(accountPublicAccessBlock.IgnorePublicAcls),
+				"restrict_public_buckets": awssdk.BoolValue(accountPublicAccessBlock.RestrictPublicBuckets),
+			},
+		),
+	)
+
+	return results, err
+}

enumeration/remote/aws_s3_scanner_test.go

@@ -3,6 +3,7 @@ package remote
 import (
 	"testing"
 
+	"github.com/aws/aws-sdk-go/service/s3control"
 	"github.com/snyk/driftctl/enumeration"
 	"github.com/snyk/driftctl/enumeration/remote/alerts"
 	"github.com/snyk/driftctl/enumeration/remote/aws"
@@ -1066,3 +1067,82 @@ func TestS3BucketAnalytic(t *testing.T) {
 		})
 	}
 }
+
+func TestS3AccountPublicAccessBlock(t *testing.T) {
+	dummyError := errors.New("this is an error")
+
+	tests := []struct {
+		test           string
+		mocks          func(*repository.MockS3ControlRepository, *mocks.AlerterInterface)
+		assertExpected func(t *testing.T, got []*resource.Resource)
+		wantErr        error
+	}{
+		{
+			test: "existing access block",
+			mocks: func(repository *repository.MockS3ControlRepository, alerter *mocks.AlerterInterface) {
+				repository.On("GetAccountID").Return("123456")
+				repository.On("DescribeAccountPublicAccessBlock").Return(&s3control.PublicAccessBlockConfiguration{
+					BlockPublicAcls:       awssdk.Bool(false),
+					BlockPublicPolicy:     awssdk.Bool(true),
+					IgnorePublicAcls:      awssdk.Bool(false),
+					RestrictPublicBuckets: awssdk.Bool(true),
+				}, nil)
+			},
+			assertExpected: func(t *testing.T, got []*resource.Resource) {
+				assert.Len(t, got, 1)
+				assert.Equal(t, got[0].ResourceId(), "123456")
+				assert.Equal(t, got[0].ResourceType(), resourceaws.AwsS3AccountPublicAccessBlock)
+				assert.Equal(t, got[0].Attributes(), &resource.Attributes{
+					"block_public_acls":       false,
+					"block_public_policy":     true,
+					"ignore_public_acls":      false,
+					"restrict_public_buckets": true,
+				})
+			},
+		},
+		{
+			test: "cannot list access block",
+			mocks: func(repository *repository.MockS3ControlRepository, alerter *mocks.AlerterInterface) {
+				repository.On("DescribeAccountPublicAccessBlock").Return(nil, dummyError)
+			},
+			wantErr: remoteerr.NewResourceListingError(dummyError, resourceaws.AwsS3AccountPublicAccessBlock),
+		},
+	}
+
+	factory := terraform.NewTerraformResourceFactory()
+
+	for _, c := range tests {
+		t.Run(c.test, func(tt *testing.T) {
+			scanOptions := ScannerOptions{}
+			remoteLibrary := common.NewRemoteLibrary()
+
+			// Initialize mocks
+			alerter := &mocks.AlerterInterface{}
+			fakeRepo := &repository.MockS3ControlRepository{}
+			c.mocks(fakeRepo, alerter)
+
+			var repo repository.S3ControlRepository = fakeRepo
+
+			remoteLibrary.AddEnumerator(aws.NewS3AccountPublicAccessBlockEnumerator(
+				repo, factory,
+				tf.TerraformProviderConfig{DefaultAlias: "us-east-1"},
+				alerter,
+			))
+
+			testFilter := &enumeration.MockFilter{}
+			testFilter.On("IsTypeIgnored", mock.Anything).Return(false)
+
+			s := NewScanner(remoteLibrary, alerter, scanOptions, testFilter)
+			got, err := s.Resources()
+			assert.Equal(tt, c.wantErr, err)
+			if err != nil {
+				return
+			}
+
+			c.assertExpected(tt, got)
+			alerter.AssertExpectations(tt)
+			fakeRepo.AssertExpectations(tt)
+			testFilter.AssertExpectations(tt)
+		})
+	}
+}

enumeration/resource/aws/aws_s3_account_public_access_block.go

@@ -0,0 +1,3 @@
+package aws
+
+const AwsS3AccountPublicAccessBlock = "aws_s3_account_public_access_block"

enumeration/resource/resource_types.go

@@ -99,11 +99,11 @@ var supportedTypes = map[string]ResourceTypeMeta{
 	"aws_s3_bucket_metric":                  {},
 	"aws_s3_bucket_notification":            {},
 	"aws_s3_bucket_policy":                  {},
-	"aws_s3_bucket_public_access_block":     {},
-	"aws_security_group": {children: []ResourceType{
+	"aws_s3_bucket_public_access_block":     {}, "aws_security_group": {children: []ResourceType{
 		"aws_security_group_rule",
 	}},
-	"aws_security_group_rule": {},
+	"aws_s3_account_public_access_block": {},
+	"aws_security_group_rule":            {},
 	"aws_sns_topic": {children: []ResourceType{
 		"aws_sns_topic_policy",
 	}},

pkg/cmd/scan/output/html.go

@@ -25,6 +25,7 @@ const HTMLOutputType = "html"
 const HTMLOutputExample = "html://PATH/TO/FILE.html"
 
 // assets holds our static web content.
+//
 //go:embed assets/*
 var assets embed.FS
 

pkg/iac/terraform/state/terraform_state_reader_test.go

@@ -114,6 +114,7 @@ func TestTerraformStateReader_AWS_Resources(t *testing.T) {
 		{name: "Route 53 record - empty records", dirName: "aws_route53_record_null_records", wantErr: false},
 		{name: "s3 full", dirName: "aws_s3_full", wantErr: false},
 		{name: "s3 bucket public access block", dirName: "aws_s3_bucket_public_access_block", wantErr: false},
+		{name: "s3 account public access block", dirName: "aws_s3_account_public_access_block", wantErr: false},
 		{name: "RDS DB instance", dirName: "aws_db_instance", wantErr: false},
 		{name: "RDS DB Subnet group", dirName: "aws_db_subnet_group", wantErr: false},
 		{name: "Lambda function", dirName: "aws_lambda_function", wantErr: false},

pkg/iac/terraform/state/test/aws_s3_account_public_access_block/results.golden.json

@@ -0,0 +1,14 @@
+[
+ {
+  "Id": "526954929923",
+  "Type": "aws_s3_account_public_access_block",
+  "Attrs": {
+   "account_id": "526954929923",
+   "block_public_acls": true,
+   "block_public_policy": true,
+   "id": "526954929923",
+   "ignore_public_acls": false,
+   "restrict_public_buckets": false
+  }
+ }
+]

pkg/iac/terraform/state/test/aws_s3_account_public_access_block/terraform.tfstate

@@ -0,0 +1,31 @@
+{
+  "version": 4,
+  "terraform_version": "1.3.0",
+  "serial": 122,
+  "lineage": "2587700f-4037-8fdb-866a-dfa7d4f613a2",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "aws_s3_account_public_access_block",
+      "name": "example",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "account_id": "526954929923",
+            "block_public_acls": true,
+            "block_public_policy": true,
+            "id": "526954929923",
+            "ignore_public_acls": false,
+            "restrict_public_buckets": false
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": []
+}

pkg/middlewares/aws_s3_bucket_public_access_block_reconcilier.go

@@ -18,12 +18,15 @@ import (
 // - Apply tf code
 // - Run a scan with the driftignore from the test folder (ignore everything but bucket and public access block)
 //   - Infra should be in sync (be sure that you have no dangling bucket in your aws test env)
+//
 // - Create a new unmanaged bucket from the console, with every option from the policy block set to false
 // - Run the scan again
 //   - One resource should be unmanaged: the bucket (expected behavior)
+//
 // - Go to the console and update public access block for that bucket
 // - Run the scan again
 //   - We should now have a new public access block resource unmanaged (expected)
+//
 // - Now uncheck back all things in the public block you just updated
 // - Run the scan again
 //   - We still have the public block as unmanaged, this is NOT expected since all values are back to default

pkg/resource/aws/aws_s3_account_public_access_block.go

@@ -0,0 +1,3 @@
+package aws
+
+const AwsS3AccountPublicAccessBlockResourceType = "aws_s3_account_public_access_block"

pkg/resource/aws/metadata_test.go

@@ -98,6 +98,7 @@ func TestAWS_Metadata_Flags(t *testing.T) {
 		aws.AwsS3BucketNotificationResourceType:            {resource.FlagDeepMode},
 		aws.AwsS3BucketPolicyResourceType:                  {resource.FlagDeepMode},
 		aws.AwsS3BucketPublicAccessBlockResourceType:       {},
+		aws.AwsS3AccountPublicAccessBlockResourceType:      {},
 		aws.AwsSecurityGroupResourceType:                   {resource.FlagDeepMode},
 		aws.AwsSnsTopicResourceType:                        {resource.FlagDeepMode},
 		aws.AwsSnsTopicPolicyResourceType:                  {resource.FlagDeepMode},

pkg/resource/resource_types.go

@@ -102,6 +102,7 @@ var supportedTypes = map[string]ResourceTypeMeta{
 	"aws_s3_bucket_notification":            {},
 	"aws_s3_bucket_policy":                  {},
 	"aws_s3_bucket_public_access_block":     {},
+	"aws_s3_account_public_access_block":    {},
 	"aws_security_group": {children: []ResourceType{
 		"aws_security_group_rule",
 	}},

test/aws/s3.go

@@ -3,12 +3,17 @@ package aws
 import (
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/aws/aws-sdk-go/service/s3/s3iface"
+	"github.com/aws/aws-sdk-go/service/s3control/s3controliface"
 )
 
 type FakeS3 interface {
 	s3iface.S3API
 }
 
+type FakeS3Control interface {
+	s3controliface.S3ControlAPI
+}
+
 type FakeRequestFailure interface {
 	s3.RequestFailure
 }