AWS S3 bucket access control lists (ACLs) in use misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_65
Category - Subcategory	Public Exposure - Storage Buckets
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	b8e3f191-9cfb-4707-8a82-cb5f784f7694

Impact

Amazon S3 Access Control Lists (ACLs) allow users to specify granular permissions on S3 objects. While they provide flexible permission options, they can also be a source of misconfigurations that could lead to unintended data exposure.

Enabling the bucket ownership controls with the BucketOwnerEnforced rule ensures that only the bucket owner has access to the S3 objects, thus effectively disabling any public ACL permissions. Ensuring that ACLs for S3 buckets are disabled reduces the risk of unintended data exposure, especially when there are multiple AWS accounts.

How to Fix

Resource: aws_s3_bucket_ownership_controls

• Arguments: rule.object_ownership [source,go]

---

resource "aws_s3_bucket_ownership_controls" "example" { bucket = aws_s3_bucket.example.bucket

rule {

• object_ownership = "BucketOwnerEnforced" } }

---