Control: 5.1 Ensure that OSS bucket is not anonymously or publicly accessible
Description
It is recommended that the access policy on OSS bucket does not allows anonymous and/or public access.
Remediation
The anonymous or public access to OSS bucket can be restricted through both Bucket ACL and Bucket Policy.
From Console
Using the Bucket ACL:
- Logon to OSS console.
- In the bucket-list pane, click on a target OSS bucket.
- Click on
Basic Settingin top middle of the console. - Under ACL section, click on
configure. - Click
Private. - Click
Save.
Using Bucket Policy:
- Logon to OSS console.
- Click Bucket, and then click the name of target bucket.
- Click the
Filestab. On the page that appears, clickAuthorize. - In the Authorize dialog box that appears, click
Authorize. - In the Authorize dialog box that appears, choose the
Anonymous Accounts (*)for Accounts and chooseNonefor Authorized Operation.
Usage
Run the control in your terminal:
powerpipe control run alicloud_compliance.control.cis_v100_5_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run alicloud_compliance.control.cis_v100_5_1 --shareSQL
This control uses a named query:
select 'acs:oss:::' || name as resource, case when acl = 'private' then 'ok' else 'alarm' end as status, case when acl = 'private' then title || ' not publicly accessible.' else name || ' publicly accessible.' end as reason , account_id as account_id, region as regionfrom alicloud_oss_bucket;