Metadata

Id: ansible-aws-s3-bucket-acl-allows-read-to-any-authenticated-user

Provider: AWS

Platform: Ansible

Severity: High

Category: Access Control

Learn More

• Provider Reference

Description

S3 objects or buckets configured with the authenticated-read ACL allow any AWS authenticated user to read your data. This exposes content beyond your account boundary and increases the risk of unauthorized data access or leakage.

In Ansible, tasks using the amazon.aws.s3_object or s3_object modules must not set the permission parameter to authenticated-read. Prefer permission: private or enforce access via explicit bucket policies or IAM roles. This rule flags Ansible tasks where permission is exactly authenticated-read.

Secure example:

- name: Upload file to S3 with private ACL
  amazon.aws.s3_object:
    bucket: my-bucket
    object: path/file.txt
    src: /local/file.txt
    permission: private

Compliant Code Examples

- name: Create an empty bucket
  amazon.aws.s3_object:
    bucket: mybucket
    object: my-object
    mode: create
- name: Create an empty bucket2
  amazon.aws.s3_object:
    bucket: mybucket
    object: my-object-2
    mode: create
    permission: private

Non-Compliant Code Examples

---
- name: Create an empty bucket2
  amazon.aws.s3_object:
    bucket: mybucket
    object: my-object
    mode: create
    permission: authenticated-read