rules:
- id: all-origins-allowed
  patterns:
  - pattern-inside: cors_rule { ... }
  - pattern: allowed_origins = ["*"]
  languages:
  - hcl
  severity: WARNING
  message: CORS rule on bucket permits any origin
  metadata:
    references:
    - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors
    cwe:
    - 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains'
    category: security
    technology:
    - terraform
    - aws
    owasp:
    - A05:2021 - Security Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW