S3 bucket objects should not allow public listing via ACL

s3
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

Modify your bucket ACL to remove public READ access.

Rationale

  • Public READ access allows the grantee to list all objects within your bucket and exploit objects with misconfigured ACL permissions.

For more information about S3 bucket ACLs, see the Access control list (ACL) documentation.

Remediation

From the console

Follow the Controlling access to a bucket with user policies docs to edit your existing policy and set the policy permissions to private.

From the command line

  1. Run put-bucket-acl with your S3 bucket name and the ACL set to private.

    aws s3api get-bucket-acl
 --bucket your-bucket-name
 --acl private