S3 buckets must not be configured to allow read access to all users. Public-read ACLs make objects and metadata accessible to anyone on the internet, risking data exposure and compliance violations.
For Ansible tasks using the amazon.aws.s3_object or s3_object modules, the permission parameter must not be set to values that start with public-read (for example public-read or public-read-write). Tasks with permission omitted or set to restrictive values such as private, or that rely on explicit bucket policies to grant scoped access, are acceptable. Resources with permission starting with public-read are flagged. Secure configuration example:
- name:Create S3 bucket with private ACLamazon.aws.s3_object:bucket:my-bucketpermission:privatemode:create
Compliant Code Examples
- name:Create an empty bucketamazon.aws.s3_object:bucket:mybucketobject:my-objectmode:createpermission:private- name:Create an empty bucket2amazon.aws.s3_object:bucket:mybucketobject:my-object-2mode:create
Non-Compliant Code Examples
---- name:Create an empty bucketamazon.aws.s3_object:bucket:mybucketobject:my-objectmode:createpermission:public-read- name:Create an empty bucket2amazon.aws.s3_object:bucket:mybucketobject:my-object-2mode:createpermission:public-read-write
1
2
rulesets:- Ansible / AWS # Rules to enforce / AWS.
맞춤형 데모 요청
Datadog 시작하기
Ask AI
AI-generated responses may be inaccurate. Verify important info.
