S3 objects or buckets configured with the authenticated-read ACL allow any AWS authenticated user to read your data. This exposes content beyond your account boundary and increases the risk of unauthorized data access or leakage.
In Ansible, tasks using the amazon.aws.s3_object or s3_object modules must not set the permission parameter to authenticated-read. Prefer permission: private or enforce access via explicit bucket policies or IAM roles. This rule flags Ansible tasks where permission is exactly authenticated-read.
Secure example:
- name:Upload file to S3 with private ACLamazon.aws.s3_object:bucket:my-bucketobject:path/file.txtsrc:/local/file.txtpermission:private
Compliant Code Examples
- name:Create an empty bucketamazon.aws.s3_object:bucket:mybucketobject:my-objectmode:create- name:Create an empty bucket2amazon.aws.s3_object:bucket:mybucketobject:my-object-2mode:createpermission:private
Non-Compliant Code Examples
---- name:Create an empty bucket2amazon.aws.s3_object:bucket:mybucketobject:my-objectmode:createpermission:authenticated-read
1
2
rulesets:- Ansible / AWS # Rules to enforce / AWS.
맞춤형 데모 요청
Datadog 시작하기
Ask AI
AI-generated responses may be inaccurate. Verify important info.
