S3 Buckets shouldn't be Publicly Open for Reads

Allowing public access to a S3 bucket can lead to having your company's data exposed. Leaving a S3 bucket open for public reads can lead to severe security issues such as data loss and unexpected charges on your AWS bill.

Article Tags
On This Page
ParametersWhat this rule checksRemediation

Parameters

None

What this rule checks

The S3 Buckets shouldn't be Publicly Open for Reads rule checks the following two conditions are met:

  • That READ or READ_ACP access is not granted to groups AllUsers or AllAuthenticatedUsers.
  • The s3:GetGetObject action with the effect of Allow is not granted to principal:*.

Failing policy example:

{
  "Id": "Policy1234567890",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowGetData",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::app/*",
      "Principal": "*" ## <--- this will cause the rule to fail
    }
  ]
}

Remediation

Remediating READ and READ_ACP access:
  1. To stop your S3 bucket from being publicly open use the put-bucket-acl command to update the bucket permissions.
aws s3api put-bucket-acl
    --bucket app
    --acl private
  1. Repeat step 1 for each bucket that you want to reconfigure.
Remediating principal:* access:
  1. To stop a bucket from being accessible to everyone you will need to create a bucket policy that restricts the principal. The following example allows access to the bucket for only the root user. Here is an example:
{
  "Id": "Policy1234567890",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowGetData",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::app/*",
      "Principal": { "AWS": "arn:aws:iam::123456789012:root" }
    }
  ]
}
  1. Use the delete-bucket-policy to completely remove the public access from the bucket.
aws s3api delete-bucket-policy
	--bucket app
  1. Use the put-bucket-policy command with the bucket policy that you created in step 1.
aws s3api put-bucket-policy
	--bucket webapp
	--policy file://bucket-policy.json
  1. Repeat steps 1-3 for each bucket that is failing.