AWS S3 bucket ACL grants READ permission to everyone misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_20
Category - Subcategory	Storage - Permissions
Provider	AWS
Severity	HIGH
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows READ access to everyone can provide attackers the ability to read object data within the bucket, which can lead to the exposure of sensitive data. The only S3 buckets that should be globally accessible for unauthenticated users or for Any AWS Authenticate Users are those used for hosting static websites.A bucket ACL helps manage access to S3 bucket data. We recommend ensuring AWS S3 buckets are not publicly accessible for READ actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

How to Fix

Resource: AWS::S3::Bucket.data

• Arguments: Properties.AccessControl [source,go]

---

Type: AWS::S3::Bucket Properties: ...

• AccessControl: PublicReadWrite / PublicRead

---