S3 bucket ACLs should block public write actions

s3
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Modify your access control permissions to remove WRITE_ACP, WRITE, or FULL_CONTROL access for all AWS users or any authenticated AWS user.

Rationale

  • Public WRITE_ACP access gives anyone permissions to change the S3 bucket Access Control List. With these permissions, anyone can grant any permissions they want, such as reading or writing objects inside the bucket.

  • Public WRITE access allows the grantee to create new objects in the bucket. For the bucket and object owners of existing objects, also allows deletions and overwrites of those objects.

  • Public FULL_CONTROL access allows the grantee the READ, WRITE, READ_ACP, and WRITE_ACP permissions on the bucket.

For more information about S3 bucket ACLs, see the Access control list (ACL) documentation.

Remediation

From the console

Follow the Controlling access to a bucket with user policies docs to edit your existing policy and set the policy permissions to private.

From the command line

  1. Run put-bucket-acl with your S3 bucket name and the ACL set to private.
aws s3api put-bucket-acl
  --bucket your-bucket-name
  --acl private