AWS S3 bucket has global view ACL permissions enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_375
Category - Subcategory	Public Exposure - Storage Buckets
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	50bb0789-ec44-4b33-b409-43d6c6ea49af

Impact

This rule detects whether AWS S3 buckets have global view ACL (Access Control List) permissions enabled. It aims to prevent buckets from being publicly accessible, which could occur if global read permissions are granted through its ACL settings.

How to Fix

Resource: aws_s3_bucket_acl

• Arguments: access_control_policy

Set your AWS S3 bucket ACL to private to avoid global view permissions. Do not use settings like public-read, public-read-write, or authenticated-read. Instead, use specific bucket policies and IAM roles to restrict access.

This example demonstrates how to modify your Terraform configuration to ensure the S3 bucket's ACL does not have global view ACL permissions. [source,go]

resource "aws_s3_bucket_acl" "example" { ... access_control_policy { grant { grantee { type = "Group"

• uri = "http://acs.amazonaws.com/groups/global/AllUsers" } permission = "READ_ACP" } }

---