Ensure bucket policy is enforced with least privileges for all AWS S3 buckets

HIGH

Description

Overly permissive Amazon S3 buckets may lead to unauthorized access.

Remediation

In AWS Console -

  1. Sign in to the AWS console and go to the S3 console.
  2. Choose the bucket you wish to edit.
  3. Select the Permissions tab.
  4. Confirm your public access settings.
  5. Under Bucket policy, select Edit and edit the policy accordingly.
  6. Select Save changes.

In Terraform -

  1. For each aws_s3_bucket resource, add an aws_s3_bucket_policy resource.
  2. Each aws_s3_bucket_policy should have a policy with Principal permissions clearly defined, rather than using wildcards.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy

Policy Details

Rule Reference ID: AC_AWS_0215
CSP: AWS
Remediation Available: Yes
Resource: aws_s3_bucket
Resource Category: Storage
Resource Type: S3 Bucket

Frameworks