Skip to main content

S3 Buckets shouldn't be Publicly Open for Reads

Allowing public access to a S3 bucket can lead to having your company's data exposed. Leaving a S3 bucket open for public reads can lead to severe security issues such as data loss and unexpected charges on your AWS bill.

Parameters​

None

What This Rule Checks​

The S3 Buckets shouldn't be Publicly Open for Reads rule checks the following two conditions are met:

  • READ or READ_ACP access is not granted to groups AllUsers or AllAuthenticatedUsers

  • The s3:GetObject action with the effect of Allow is not granted to principal:*.

Failing policy example:

{
  "Id": "Policy1234567890",
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "AllowGetData",
          "Action": [
              "s3:GetObject",
              "s3:PutObject",
              "s3:DeleteObject"
          ],
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::app/*",
          "Principal": "*" # This will cause the rule to fail
      }
  ]
}

Remediation​

Remediating READ and READ_ACP access​

  1. Use the put-bucket-acl command to update the bucket permissions:

    aws s3api put-bucket-acl --bucket my-bucket-name --acl private

  2. Repeat step 1 for each bucket that is to be reconfigured

Remediating principal:* access​

  1. To stop a bucket from being accessible to everyone you will need to create a bucket policy that restricts the principal. The following example allows access to the bucket for only the root user. Here is an example:

    {
      "Id": "Policy1234567890",
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowGetData",
          "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:DeleteObject"
          ],
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::app/*",
          "Principal": { "AWS": "arn:aws:iam::123456789012:root" }
        }
      ]
    }

  2. Use the delete-bucket-policy to completely remove the public access from the bucket

    aws s3api delete-bucket-policy --bucket my-bucket-name

  3. Use the put-bucket-policy command with the bucket policy that you created in step 1

    aws s3api put-bucket-policy --bucket my-bucket-name --policy file://bucket-policy.json

  4. Repeat steps 1-3 for each bucket that is failing